Re:What You Get After Running an SSH Honeypot for 30 Days
by appstorelottery on Sunday June 16, 2024 @05:29AM
(#40695801)
Would be cool to have a "don't scan me bro" list of IP's that engage in this that we could share - is there such a thing?
Re:What You Get After Running an SSH Honeypot for 30 Days
by BLKNSLVR on Sunday June 16, 2024 @05:51AM
(#40695881)
The problem is that becomes a concentrator of IPs behind which privacy conscious individuals exist, which probably has higher value to "whoever's buying". It's a conundrum.
Re:What You Get After Running an SSH Honeypot for 30 Days
by yesbabyyes on Sunday June 16, 2024 @06:47AM
(#40696091)
It sounds like what GP is suggesting is to collect ips of all the scanners, and share the list of ips among ourselves, so we can collectively route their traffic to /dev/null.
Re:What You Get After Running an SSH Honeypot for 30 Days
by BLKNSLVR on Sunday June 16, 2024 @07:02AM
(#40696146)
aaaaah, that makes sense. See the links in my original post.
Re:What You Get After Running an SSH Honeypot for 30 Days
by kjkjadksj on Sunday June 16, 2024 @12:26PM
(#40698218)
Why not also sell the scans of scanners to the scanners customers and make a little pocket change?
Re:What You Get After Running an SSH Honeypot for 30 Days
by dataflow on Sunday June 16, 2024 @06:06AM
(#40695931)
You're being sarcastic, right? We did this for telephone numbers and saw how it turned out...
Re:What You Get After Running an SSH Honeypot for 30 Days
by zbentley on Sunday June 16, 2024 @08:42AM
(#40696633)
There's a comment downthread discussing something similar; I haven't tried it though: https://news.ycombinator.com/item?id=40695179
Re:What You Get After Running an SSH Honeypot for 30 Days
by drpixie on Sunday June 16, 2024 @09:44PM
(#40701606)
Yes - Anyone who's FAQ answer to "How to avoid being scanned" is "We don't have an opt-out, you must block all these addresses" isn't behaving like a legit business.
"Nice network you've got there."
"We noticed something might be open. We're not telling you what it is."
"It would be a pity if something happened to your business."
"Give us lots of money."
Sounds like a movie strong-arm thug.
This is both subjective and highly dependent upon the scope of services being run. My setup would probably progressively create more hassle than it saves as one a scale from small business to large business. For the setup I have, I quite specifically want to block their traffic.
I'm possibly overly militant about this, but they keep databases of the results of their scans, and their business is selling this information to ... whoever's buying. I don't want my IP addresses, open ports, services or any other details they're able to gather to be in these databases over which I have no control and didn't authorise.
To steal an oft-used analogy, they're taking snapshots of all the houses on all the streets and identifying the doors, windows, gates, and having a peek inside, and recording all the result in a database.
I believe all of them are illegitimate. They 'do' because they can, and it's profitable. "Making the internet safer" is not their raison d'être.
Happy for any else to form their own opinion, but this is my current stance.