Hacker News new | ask | show | jobs
by kees99 97 days ago
> bunch of organisations that just probe the entire IPv4 range on a regular basis

Yep, #1 source of junk traffic, in my experience. I set those prefixes go right into nullroute on every server I set up:

https://raw.githubusercontent.com/UninvitedActivity/Uninvite...

#2 are IP ranges of Azure, DO, OVH, vultr, etc... A bit harder to block those outright.
1 comments
miyuru 96 days ago
In my servers I dont have IPv4 at all, just IPv6 only.

On the plus side, it does not waste CPU cycles used to block unwanted IPv4 traffic.

link
kees99 96 days ago
That helps a bit, true.

But not that much, unfortunately. Those same "cYbeRseCUrITy" orgs also ingest SSL transparency logs, resolve A and AAAA for all the names in the cert, then turn around and start scanning those addresses.

In my experience, it only takes a few hours from getting an SSL certificate to junk traffic to start rolling in, even for IPv6-only servers.

Small percentage of that could be attributed directly, based on "BitSightBot", "CMS-Checker", "Netcraft Web Server Survey", "Cortex-Xpans" and similar keywords in user-agent and referer headers. And purely based on timing, there's a lot more of that stuff where scanners try and blend in.

link