What's the deal with openportstats.com? | Hacker News Reader

What's the deal with openportstats.com?

isc.sans.edu

64 pointskencausey16 comments

Related or not: I have been running ssh on several internal but internet facing systems on non-standard port numbers for years there have been virtually no log in attempts on these ports. In the last 6-9 months activity has increased a lot. Most addresses make 5 connection attempts and then go away. Not really a case for fail2ban. I could ban them after 3 so save 40%...

No country particlarly stands out. Digitalocean and Korea maybe I bit more than I would have expected.

When I set up my Pihole, I mistakenly left UDP port 53 open to the world and passing through to the Pihole. It got found and used within 4-5 days.

Noticed the Pihole stats for non-router clients (I made it to redirect all local outbound DNS traffic to itself) and fixed it but it was curious regardless. Thought it was going to be found and abused much sooner. Especially with such a prominent and well-known port as DNS.

Similar story here, except I have 551 attempts in the last 72 hours alone. Mostly Singapore and China.

The site itself looks like a front. It's the bare minimum of a website, a template and images with non-transparent backgrounds. Compounding with contact information not working, this should ring alarm bells for most.

For those who are curious what it looks like but don't want to visit it, here are shots from LambdaTest.

Desktop: https://i.imgur.com/moLNdTo.png

Mobile: https://i.imgur.com/ci5037w.png

please consider not using imgur.

it does not return the image even if the url directly points to it and does not work correctly with a lot of browsers.

Good to know, what's a better alternative that doesn't require a login?

https://postimages.org/ is what I've taken to using, once Imgur became bloated and annoying to upload to.

(FWIW, the direct link to Imgur images above do work for me, as in loading only the images. I have JS disabled, but I don't think that makes a difference in this case.)

The imgur link doesn't work for me and I'm running Firefox with JS disabled.

I just get a text saying:

If you're seeing this message, that means JavaScript has been disabled on your browser, please enable JS to make Imgur work.

EDIT: I've disabled showing the referer in Firefox and the link works fine now. Imgur must be looking at the referer and redirecting when coming in from outside the website.

What could be the risk visiting the site?

It's not about risk, it's about it being annoying. When I click a link where the hostname is i.imgur.com and the path ends with jpg/png/gif, I want my browser to load a single image resource and not an HTML page.

And, somewhat randomly: A list of countries and what they claim to be the IPs in that country on a subdomain:

http://countries.openportstats.com/

>It's the bare minimum of a website, a template and images with non-transparent backgrounds.

To be honest, if I were doing a pretty bare bones but legit web app that was of the more informative type and did not have to have much customer engagement, a template or an unoriginal design like that is likely something I would use.

Not saying the site is legit, but there's nothing wrong with using a template with some simple custom images. People on HN are constantly complaining about overengineered websites.

Ok, neat. And now I'm motivated to find the source for how nmap picks `--top-ports`.

Clickbaity title

Reply on news.ycombinator.com