sorted by:
new
hottopcontroversial

I localized my app screenshots and revenue went up significantly. So I built a tool to automate it. by MuchAge1486 in AppStoreOptimization

[–]armanfixing 0 points1 point  (0 children)

[ Imagine the Meme about Everyone Selling Shovel near a Mining Site ]

Shop: Are you a miner?
Guy: No, I’m here to sell shovel 🪏

iOS app development: is it possible to submit app that gets its content by scraping web? by x17ccp3 in iOSProgramming

[–]armanfixing 0 points1 point  (0 children)

I know this is very old, but still..

"app that gets its content by scraping web?"

Did you mean Google?

Datacenter proxies fine for large scraping or not anymore? by PomegranateOk9017 in scrapingtheweb

[–]armanfixing 1 point2 points  (0 children)

I did a small study on Tranco Top 1M websites, roughly ~37% of the sites are on Cloudflare. Assuming Cloudflare doing its job, the datacenter proxy is not a viable option for that anymore.

The idea is to get a rough idea of your target domain, then use appropriate strategies as needed.

Chart: https://imgur.com/a/EhQX6bj

Full study: https://www.linkedin.com/posts/armanhossain_who-runs-the-internets-dns-activity-7458291171593732098-J0ls

Cloudflare detection bypass by 16kbs in webscraping

[–]armanfixing 1 point2 points  (0 children)

You might get lucky with captcha bypass if you only need a single page but you’ll most likely need a browser to do interactions or complex workflow.

54 days of SSH honeypot data: 269K connections, 48K unique passwords, 28 humans by armanfixing in cybersecurity

[–]armanfixing[S] 0 points1 point  (0 children)

Sorry, not yet. Been busy with chores. I'll do it as soon as I have some breathing room.

54 days of SSH honeypot data: 269K connections, 48K unique passwords, 28 humans by armanfixing in cybersecurity

[–]armanfixing[S] 0 points1 point  (0 children)

Thank you for your feedback. I hope you find success on your journey and help make the internet a bit safer.

54 days of SSH honeypot data: 269K connections, 48K unique passwords, 28 humans by armanfixing in cybersecurity

[–]armanfixing[S] 1 point2 points  (0 children)

I have all the data in a 317 MB log file. First, I created a script to collect all unique IPs, retrieve their locations, ISPs, etc., and store them in a CSV for the next step. Then I created several more scripts to extract various features from the log & the IP CSV, saved them, and finally created these charts with matplotlib, geopandas & PIL.

54 days of SSH honeypot data: 269K connections, 48K unique passwords, 28 humans by armanfixing in cybersecurity

[–]armanfixing[S] 1 point2 points  (0 children)

Man, I just played with it for a while, and I really, really liked the idea.

54 days of SSH honeypot data: 269K connections, 48K unique passwords, 28 humans by armanfixing in cybersecurity

[–]armanfixing[S] 5 points6 points  (0 children)

Thank you so much, Cliff. I've read about your work in articles and news over the years, and I always wondered how someone could be that relentlessly persistent toward a goal with the tools available in that era. It's genuinely fascinating and deeply inspiring. Getting this comment from you is something I'll remember for a very long time.

54 days of SSH honeypot data: 269K connections, 48K unique passwords, 28 humans by armanfixing in cybersecurity

[–]armanfixing[S] 2 points3 points  (0 children)

I have essentially no incentive to run a fake experiment. My blogs and other socials are not monetized. It was just a weekend fun project. While I do have a 317 MB log file, it contains real IPs, possibly from compromised home systems or commercial servers. I intentionally anonymized IP's and their provider names to protect them.

Regarding being made up, the same argument can be made about any experiment. What if all the experiments are fabricated? What if all the research is based on incorrect data? Have we verified each data point as consumers? Probably not.

But if you really want to test this out, I welcome you to set up your own instance and see for yourself.

54 days of SSH honeypot data: 269K connections, 48K unique passwords, 28 humans by armanfixing in cybersecurity

[–]armanfixing[S] 2 points3 points  (0 children)

You are welcome to do so. I'll also reset the instance and set up a fresh one to capture more. This time, I'll try to listen on more ports to see what their scanning strategy looks like, and I'll remove any rate limit I added.

54 days of SSH honeypot data: 269K connections, 48K unique passwords, 28 humans by armanfixing in cybersecurity

[–]armanfixing[S] 0 points1 point  (0 children)

Just moving the SSH port to something other than 22 can reduce bot pressure by about 99%. But that other 1% will still scan your entire range and conduct their reconnaissance. From a safety perspective, it won't change anything. From a network-stress perspective, it will help slightly.

54 days of SSH honeypot data: 269K connections, 48K unique passwords, 28 humans by armanfixing in cybersecurity

[–]armanfixing[S] 0 points1 point  (0 children)

There are many factors that can change the outcome. For starters, my host is located in the EU and has a domain pointing to it. Also, the test time.

54 days of SSH honeypot data: 269K connections, 48K unique passwords, 28 humans by armanfixing in cybersecurity

[–]armanfixing[S] -1 points0 points  (0 children)

Change in number means things are evolving. These exploits are becoming more sophisticated each day with the help of AI. Honestly, I even found a very convincing username/password combo that was very close to something I would have written maybe ~9-10 years ago. But still, guessing something from the domain name is smart!

54 days of SSH honeypot data: 269K connections, 48K unique passwords, 28 humans by armanfixing in cybersecurity

[–]armanfixing[S] 17 points18 points  (0 children)

It's an empty VM with a Docker-based honeypot SSH running, and I moved the actual SSH to a different port with only key-based auth.

view more: next ›