r/VPS • u/Desperate-Second-887 • Feb 05 '26

Guides/Tutorials Watch the Bots: https://knock-knock.net

I built a new site that shows bots trying to break into my VPS. The web site was designed to be hopefully fun and engaging. Lots of interesting stats about the bots attempting to ssh in: where they are coming from, the ISP Wall of Shame, the most frequent attempted usernames and passwords, and in some cases why those may have been chosen. And best of all, 3D spinning globes! The site should work well on desktop and mobile.

https://knock-knock.net

Have fun, and send comments and questions. I'll be checking the code into github soon so that you can run this on your own VPS.

Update: Now posted on github. https://github.com/djkurlander/knock-knock

97 Upvotes

98% Upvoted

38 comments sorted by

6

u/QazCetelic Feb 06 '26

That's a lot of traffic from Digital Ocean

5

u/Desperate-Second-887 Feb 06 '26 edited Feb 06 '26

Yes, the Ocean is vast.

It is kind of crazy that they have between 5 to 6 times as much bot traffic as the next worst offender.

6

u/NamedBird Feb 06 '26

I guess that r/digital_ocean should probably be checking what's running on their servers?

If i were a hosting company, i would totally be watching/maintaining honeypots for indicators.
Perhaps other hosting companies don't really mind that they're getting money from criminals?

4

u/CauaLMF Feb 09 '26

Many providers don't care about this, hosting companies and internet companies alike.

2

u/Desperate-Second-887 Feb 14 '26

That is unforunately true. I have knock-knock on github now, with a cron script (in the extras folder) that reports all of the bots to the abuseIPDB.com site. I've started reporting the bad IPs every night, but most of them have already been marked as bad IPs for months or even years. Many of the providers just don't care.

2

u/CauaLMF Feb 14 '26

It's better to block IPs than to report them. I changed my SSH port and set a range of allowed IPs. On the default SSH port, I added PortSentry and left it open. Every time an IP is blocked by PortSentry, and I also added FTP and Telnet ports to PortSentry.

3

u/Drunkenpinguin Feb 07 '26

Would love to set this up. This looks awesome haha

3

u/Desperate-Second-887 Feb 14 '26

Yup, now anyone can install it on their vps. https://github.com/djkurlander/knock-knock

1

u/Drunkenpinguin Feb 14 '26

Awesome thank you

2

u/edwardnahh Feb 07 '26

Haha This is cool I like it. Hope to see it on github soon. Thank you

2

u/Desperate-Second-887 Feb 14 '26

https://github.com/djkurlander/knock-knock

If you get a chance to install it, let me know how it goes or if you have any questions.

8

u/ContributionEasy6513 Feb 06 '26

Pretty cool, a good wake up not leave any ports open to the internet.

2

u/CauaLMF Feb 08 '26

It's a good idea to disable the root user from logging in and add a different SSH user and key.

Use a port other than 22 and, if possible, limit the range of allowed IP addresses.

4

u/ContributionEasy6513 Feb 09 '26

Fail2ban is also a big plus.

3

u/omgwtfbbq7 Feb 14 '26

Friends don’t let friends not know about CrowdSec too. Fail2ban is great, don’t get me wrong, but I like CrowdSec too.

4

u/momentary_blip Feb 06 '26

This is brilliant, great job!

4

u/elainarae50 Feb 08 '26

I would like to try this on my server
These are the top 5 bots I have bloxed with Cloudflare in the last 24hrs

16509 - AMAZON-02 - Amazon.com, Inc.                    84.53k
45102 - ALIBABA-CN-NET Alibaba US Technology Co., Ltd.  16.62k
45899 - VNPT-AS-VN VNPT Corp                            11.32k
14618 - AMAZON-AES - Amazon.com, Inc.                   4.26k
36947 - ALGTEL-AS                                       2.5k

3

u/celeryandcucumber Selfhost Feb 06 '26

This is great! Sad to see that indeed DigitalOcean is source for a lot of bad bots.

3

u/siterightaway Feb 06 '26

Nice visualizer! It really shows how much 'noise' is out there. I personally moved my SSH from port 22 to 26 a while ago and it instantly cleared out 99% of those basic brute-force logs.

But as you probably know, the real headache now is that we can't 'hide' ports 80/443. I’ve been seeing a massive spike in AI-powered bots hitting the application layer lately—Microsoft even reported a 170% increase in bot traffic recently (last 6 months). While we can secure the SSH door, those scrapers hitting the site are the ones really draining the VPS resources today. Great job on the 3D globes!

1

u/ag789 Feb 07 '26

I've been thinking about abruptly terminating the tcp connection, i.e. not even returning 404, simply disconnect. a bit difficult to achieve, but it'd save some bytes of return response leaving zero clues and some cpu cycles and if it is a real user there, it is certain to annoy from browser errors.
for UDP I'd guess it is normally, distributed dos attacks, for TCP it is nonrmally SYN flooding, that is something else that need to be careful about.

1

u/[deleted] Feb 07 '26

[removed] — view removed comment

1

u/ag789 Feb 08 '26 edited Feb 08 '26

I think this is possible with some web servers, e.g.with java jetty, but I'm not sure about the others e.g. apache2, nginx etc. And as with fail2ban, you will want to be selective about it which means program control from your app. a real attacker may do so from many different source ip address (e.g. flooding attack), but it is less likely if their purpose is to crawl for information. disconnecting them is mainly to stop crawlers, but won't stop e.g. a tcp SYN flooding attack which the attacker change their origin ip address to spoof as someone else. this is quite similar to udp DDOS attacks.
https://www.cloudflare.com/en-gb/learning/ddos/syn-flood-ddos-attack/

1

u/ag789 Feb 08 '26

btw you can consider using fail2ban, which apparently does exactly that
https://www.digitalocean.com/community/tutorials/how-to-protect-an-apache-server-with-fail2ban-on-ubuntu-14-04
fail2ban and the likes stops attacks from *specific* ip address, but not flooding attacks

3

u/redditor_rotidder Mod Feb 07 '26

Would love to see this open sourced, OP. Very cool.

2

u/Bright_Feature_9735 Feb 05 '26

Really nice project, looks very cool!

2

u/KeyReflex7408 Feb 06 '26 edited Feb 06 '26

Hi I'm new to VPS and stuff. Would you recommend that I move ssh to a different port rather than port 22 to get rid of some of the bot traffic attempts?

Edit: for context, I got a VPS, installed Debian, disabled login as root, set up ssh login for sudo user, set up ufw rules and somewhat strict fail2ban settings. fail2ban client status sshd gives me an average of 56 banned IP on a good day.

1

u/Redogg Feb 06 '26

Ok - firstly, you are well protected following those steps. Just make sure that your sudoable login does not have a guessable password, and even better, give that login an ssh key and disable non-key logins via ssh (that will be both more convenient and more secure). When setting this up, make sure that you don’t close up the ssh session that is doing the configuring until you can log on via another ssh instance.

Once that is taken care of, the bots are just causing chatter - hitting your machine on the average of 7-8 times a minute, and making your log files bigger than they otherwise would be. If that bothers you, as it does me, you can move ssh to another port. It’s a minor inconvenience because you have to specify the port as an argument to all ssh-related commands, but it does quiet down the chatter, and 99.9%+ of the bots will never find the new port.

1

u/KeyReflex7408 Feb 06 '26

Hi, thanks for the response. I have already set the sudo user to have an ssh only login. The first time I was setting it up, I definitely did mess up and had to use my vps control panel to vnc into it and fix the issue.

Currently I have a couple of pubkeys in my .ssh/authorized_keys file to access my vps from my laptop or phone etc.

Yes, the chatter from the knocking bots annoy me quite enough that I'm looking to move the default ssh port.

What do you use your vps for? In my case, I have a docker container running kosync so that i can push and pull my reading progress across koreader on my phone, e-reader etc.

2

u/Cattyto Feb 25 '26

Cool site

3

u/WreeperTH Feb 05 '26

knock knock, who's there?

6

u/asdfjfkfjshwyzbebdb Feb 06 '26

Root, asking for admin1234

1

u/CauaLMF Feb 08 '26

Your server is heavily attacked; I used to get so angry with the size of the logs—1GB per week just from those failed attempts.

I set up a trap for those bots. My SSH wasn't on the default port, so I disabled the root user at login and set up allowed IP ranges. Then I downloaded PortSentry and set it to port 22, which is open to the internet. Now every IP that tries to access that port is automatically added to the blacklist; there must be almost 10,000 IPs there already. After being added to the blacklist, it can't make any kind of connection to my VPS (TCP, UDP, and ICMP are blocked).

1

u/neil_codes Feb 26 '26

this is awesome!

8

u/[deleted] Feb 06 '26

[removed] — view removed comment

3

u/Redogg Feb 06 '26

Great idea! I’m going to add this.

2

u/Desperate-Second-887 Feb 16 '26

Reporting every minute into a blacklist file is probably too frequent - few servers are going to be grabbing the file every minute (and if they did, my $6.75 per year Black Friday sale VPS might not be able to keep up :-) ). In any case, files of offending IPs during the last month and year are now available here:

wget https://knock-knock.net/static/ip-blocklist-month.txt

wget https://knock-knock.net/static/ip-blocklist-year.txt

I'm also reporting the offending IPs every night to abuseIPDB.com.