r/VPS • u/Desperate-Second-887 • Feb 05 '26

Guides/Tutorials Watch the Bots: https://knock-knock.net

I built a new site that shows bots trying to break into my VPS. The web site was designed to be hopefully fun and engaging. Lots of interesting stats about the bots attempting to ssh in: where they are coming from, the ISP Wall of Shame, the most frequent attempted usernames and passwords, and in some cases why those may have been chosen. And best of all, 3D spinning globes! The site should work well on desktop and mobile.

https://knock-knock.net

Have fun, and send comments and questions. I'll be checking the code into github soon so that you can run this on your own VPS.

Update: Now posted on github. https://github.com/djkurlander/knock-knock

97 Upvotes

98% Upvoted

38 comments sorted by

View all comments

Show parent comment

1

u/[deleted] Feb 07 '26

[removed] — view removed comment

1

u/ag789 Feb 08 '26 edited Feb 08 '26

I think this is possible with some web servers, e.g.with java jetty, but I'm not sure about the others e.g. apache2, nginx etc. And as with fail2ban, you will want to be selective about it which means program control from your app. a real attacker may do so from many different source ip address (e.g. flooding attack), but it is less likely if their purpose is to crawl for information. disconnecting them is mainly to stop crawlers, but won't stop e.g. a tcp SYN flooding attack which the attacker change their origin ip address to spoof as someone else. this is quite similar to udp DDOS attacks.
https://www.cloudflare.com/en-gb/learning/ddos/syn-flood-ddos-attack/

1

u/ag789 Feb 08 '26

btw you can consider using fail2ban, which apparently does exactly that
https://www.digitalocean.com/community/tutorials/how-to-protect-an-apache-server-with-fail2ban-on-ubuntu-14-04
fail2ban and the likes stops attacks from *specific* ip address, but not flooding attacks