back
228 comments
Every server with port 80/443 open has thousands of hits a day from random boxes looking for wordpress login pages. The only new thing is that they're pretending to be a different type of annoying bot. There's a new layer of sophistication and subterfuge, but it's the same junk traffic we've always dealt with.
Think about how many webmaster and business owners' egos are stroked by all the traffic they are getting, when in actuality they are often just serving thousands of bots.
Opening port 80 and realizing the world is an anarchic warzone is a canonic rite of initiation for otherwise innocent backend devs and sysadmins.
Exactly this. It's no different from a bot pretending to be Googlebot. I've tried reporting abusive IPs to various foreign hosts, but nothing every comes to it. I've settled for just blacklisting excessively abusive IP ranges.
I am always surprised that its considered legal. IMO that's the same as going on the street door by door and checking if one is left open to steal everything inside the house...
Yeah, It started bothering me enough that I recently put together a system where when a application detects a bad actor(a bot enumerating too fast, a random scan for vulnerabilities, etc) it notifies the firewall. Right now I am just shutting them down, But have plans for a honeypot/tarpit system, something real slow that takes up all their time. Something like "have fun at 300 baud"
If I had a nickel for every time my blog gets a reuqest probing some wordpress exploit, I'd have paid off my student loans years ago.
I don’t really have a reason to use WordPress anymore. I’m about halfway through switching my site over to something else that I can control with github and AI. Now these boats are mostly getting static files unless there’s a reason to show something else and even then the footprint is very small. There’s just not that much to hack.
Numbers say that the number of attacks are increasing: https://radar.cloudflare.com/security/application-layer?date...
Most servers with port 25565 open get hits from either Minecraft griefer bots, or from a bot that looks for that port and warns anyone on that server about the risks of leaving that port open. It doesn't take a huge scale operation to spam every IPv4 address in the world, there are only 2^32 of them, and even then many of those addresses are reserved.
Definitely gotten worse from where I'm standing — you used to be able to just filter on the UA string and move on, now you can't even trust that. Same junk traffic, but harder to sweep away.
Another interesting thing here is the paths they're targeting, many are for newish AI coding tools
On average about 100 (TCP) requests hit my home router per minute doing various probing and scanning. Lots of checking for the telnet port obviously. Sometimes you can see a swarm of entirely different IPs scanning the full port range (probing the ports one-by-one).

You'll see a lot of deepfield, censys-scanner, visionheight.com, shadowserver.io, etc., but also the usual suspects of Chinese or Russian IPs.

With OpenWRT I use something like this: `tcpdump -i pppoe-wan 'inbound and tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn'`, or alternatively `tcpdump -i pppoe-wan 'inbound and tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn and not port 44000'`, if we have some torrent client running (e.g. here at port 44000) which would mess up the result. I'm not sure it's the best way to handle this, but it's definitely enlightening what bounces off on the router.

The easiest way to deal with the usual suspects is to just block the entire countries network range(s). There really is no reason they should be connecting to your home router anyway, and you lose nothing from blocking them.

Sure their packets will still hit your router, but if they are dropped immediately at least you're not wasting a syn-ack on them.

I have ubiquity UniFi for this reason (amongst others). OpenWRT is a good choice as well. Most home router software is such junk, might as well leave the door open..
Many of those user-agents listed are often faked. Look up which ASN owns their IP. If I block most VPS providers most of the faked bots vanish. There are still some running from residential and phones using hijacked code (readers that are not really just readers but really multipurpose proxies). On that note, do not trust the linked source code but rather decompile the live code your phone is running and have AI analyze it.
Mass automated vulnerability scans have been a very common thing since years before the advent of this in 2001:

https://en.wikipedia.org/wiki/Code_Red_(computer_worm)

I remember when 'code red' spread and it had the effect of crapping up the contents of my apache server logs. Fun times.

such as:

GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0

Why would you voluntarily pretend to be a AI bot, when those have already a much higher chance of being blocked? Seems holly unproductive.

Best hypothesis I can come up with is to somehow make the AI companies look bad, but they seem to be doing an excellent job at that themselves already by scraping everyone hundreds of times per hour over and over.

Worth saying out loud: user-agent is not identity. Verify AI crawlers by reverse DNS or the provider's published IP ranges - the ones worth letting in all publish them.
I recently blogged about some Cloudflare Workers I developed to combat this type of traffic: https://code.backwater.systems/blog/#2026-06-29T23:40:00.000...
Very similar experience here. Started July 30, sustained through August 6, when it started a significant ramp-up in volume (5x or so).

Most of the traffic is originating in GCP. We're seeing ~70k req/min sustained from Google Cloud IP space (AS396982). Reported to GCP Abuse, they've been non-responsive so far.

The main distinguishing factor is the reuse of a bunch of legit AI-training bot UserAgent strings. It's clear that the traffic is under the same centralized control because of how it changes volume across thousands of IP addresses simultaneously.

Fake Googlebot visits are #1 in website logs I've been working on. At the beginning I was fighting with them using Cloudflare ASN block rules or their managed Bot Fight mode but it appeared to be not only pointless, but also harmful for my websites. Bot Fight mode randomly started blocking real Bing / Google / OpenAI crawlers what wasted crawling budget and discouraged crawlers to revisit updated pages.

Sometimes it's better to not fight with bots actively but harden environment and only react for the worst offenders.

Interesting thought: what if the idea of an open internet is over.

What if we're now moving into a world of strictly KYC. The same way "The Facebook" generated massive revenue by creating a KYC world.

Just in case any of the authors read HN, I'm getting a pretty crazy rendering bug on this page, where a bunch of the contents are redrawing up and down by a few pixels. It seemed to go away with resizing the width a few times, but I didn't look into it too hard. My page width was probably small on first draw. Incredibly distracting though and hard to read with the text moving. Using latest chrome, and it occurred on more than one page refresh. I didn't dig in beyond that though.
Looks like Google has started rolling out this Web Bot Auth thing which seems like something that should gain adoption or become an open standard. https://developers.google.com/crawling/docs/crawlers-fetcher...

Seems like the crawler companies would be incentivized to not want to take responsibility for people spoofing their user agents.

Someone is always running mass vulnerability scans. That's a "water is wet" state of the Internet.
How about them apples... ai bots use faked browser user agents, so people start pretending to be ai instead...
For those suggesting fail2ban as a solution, that's dinosaur software from the palaeolithic. If you have a website of any size then the number of bots will overwhelm the block list in days with their millions of unique IPs.
How can I attract more of these bots to my server? I want to test my Apache bad bot blocker. It uses basic header fingerprinting and h2 support to filter them. I get less than 5000 hits on an average day, and want a lot more.
I'm not sure what to blame yet, but here's traffic on a tiny side site, all from JS-capable clients: https://i.imgur.com/tdexrEI.png
Besides, projects with lots of dependencies are taking on more risk than they realize. If one dependency gets compromised, you have no idea how many projects are affected until it's too late.
This kind of stuff is getting pretty wild, even for using something like Cloudflare it seems like a good idea to have another layer behind it that's non-cloudflare for when vulnerabilities are discovered.
Fork found in kitchen. This is nothing new. Don't have mass vulnerabilities and you have nothing to fear from mass vulnerability scanners.
Man, this "someone" guy sounds like a real jerk!
Hah, what fools! I've been serving empty responses to AI scraper UAs for over a year now.
Why would some of these ignore robots.txt some of the time?
No Small Actors.
Or some thing!
Sorry, my bad.