Hacker News Reader

Look. Malicious boxes are attacking me. Although I must be politically correct in this situation to probably please everyone, while I probably shouldn't have logged into the router in question, I would prefer to publish such IPs because they have the potential to harm other machines.

Actually that particular IP attacked me more than 170 times. It may be useful to others to keep this address on their "naughty" list of hosts to ban.

View on HN

I don't think there's a need to publish those addresses. There are already lists with those IPs available (https://www.openbl.org/). Telling people that the IP had default password on the router will only cause the problem to the owner who may not even be aware of the attack. Proxies / worms for ssh scanning are very common, so maybe you just helped people break some Joe Random's home network.

> I don't think there's a need to publish those addresses. There are already lists with those IPs available...

Interestingly, the IP address of that router is _not_ present in either the base (attacks within the past 360 days) list or the delisted (manually removed from the base list by the person in question) list.

It's almost like no single list is terribly likely to be complete, and that publishing collation of a master list is required for completeness. :)

Reply on news.ycombinator.com