{"slug": "knock-knock", "name": "Knock-Knock", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 3, "commenters": 3, "warners": 0, "score": 2.778, "rising": 0.35, "first": "2026-04-26", "latest": "2026-09-11", "why": "You can also see a live view of the ASN/ISP leaderboard by going to https://knock-knock.net", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 0, "compare": 0, "warn": 0}, "spark": [0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "You can also see a live view of the ASN/ISP leaderboard by going to https://knock-knock.net", "kind": "", "icon": true, "domain": "knock-knock.net", "github_repo": null, "official_url": "https://knock-knock.net/", "pricing": "", "aliases": ["Knock-Knock", "knock-knock", "KnockKnock", "Knock Knock"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 794645360, "item_id": 49665335, "url": "https://news.ycombinator.com/item?id=49665335", "by": "mr_mitm", "date": "2026-09-11", "version": null, "stance": "recommend", "quote": "There is https://knock-knock.net/, which is similar", "excerpt": "There is https://knock-knock.net/, which is similar", "context": "", "use_case": "", "switched_from": "", "story": "I spent $220 on Google app ads and 60% of the installs were robots"}, {"id": 788442624, "item_id": 49277664, "url": "https://news.ycombinator.com/item?id=49277664", "by": "djkurlander", "date": "2026-08-12", "version": null, "stance": "recommend", "quote": "You can also see a live view of the ASN/ISP leaderboard by going to https://knock-knock.net", "excerpt": "Yeah, that\u2019s pretty interesting! You can also see a live view of the ASN/ISP leaderboard by going to https://knock-knock.net and choosing ISP from the carousel. That\u2019s ordered by bot transaction count rather than IP count though. It never ceases to amaze me that these ISPs don\u2019t bother to shut down the botnets. They could do so very easily. For example, they could identify the IP address of every bot that hit this ho", "context": "", "use_case": "", "switched_from": "", "story": "Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot"}, {"id": 778331118, "item_id": 48645694, "url": "https://news.ycombinator.com/item?id=48645694", "by": "unmanageduck", "date": "2026-06-23", "version": null, "stance": "recommend", "quote": "Autorun checker: KnockKnock", "excerpt": "Package manager: Nix(alternative to homebrew) https://nixos.org/download/#nix-install-macos Package management: Nix-darwin https://github.com/nix-darwin/nix-darwin Browsers: - Librewolf https://librewolf.net - Tor https://www.torproject.org - Orion https://orionbrowser.com Video downloader: Yt-dlp https://github.com/yt-dlp/yt-dlp Video/audio player: Mpv https://github.com/mpv-player/mpv Video editor: LosslessCut http", "context": "", "use_case": "autorun checking", "switched_from": "", "story": "Ask HN: New clean macOS install. Must-have apps? Best browser?"}, {"id": 766580448, "item_id": 47911278, "url": "https://news.ycombinator.com/item?id=47911278", "by": "Datahenge", "date": "2026-04-26", "version": null, "stance": "recommend", "quote": "Very nice app; great job!", "excerpt": "I love the use of color and the retro-style UI. Your INSTRUCTIONS.md was comprehensive. Appears to be CPU-heavy sometimes in the browser (spiked one of my CPUs to 100%), so could be an opportunity for optimization later. I've often wanted to show my clients how risky their brand-new VPS is without proper firewall configuration. Your Knock-Knock tool would be a great way of helping them visualize that. Very nice app; ", "context": "works with clients on VPS setups", "use_case": "visualizing bot attacks for clients", "switched_from": "", "story": "Show HN: Knock-Knock v2 \u2013 Visualizing bot attacks in multi-protocol Technicolor"}]}], "caveats": [], "who": [{"by": "Datahenge", "context": "works with clients on VPS setups", "url": "https://news.ycombinator.com/item?id=47911278", "date": "2026-04-26"}], "tags": [], "use_cases": ["autorun checking", "visualizing bot attacks for clients"], "compared": [], "makers": [{"id": 788431504, "item_id": 49276969, "url": "https://news.ycombinator.com/item?id=49276969", "by": "djkurlander", "date": "2026-08-12", "version": null, "stance": "neutral", "quote": "It's on github with an MIT license: https://github.com/djkurlander/knock-knock.", "excerpt": "It's on github with an MIT license: https://github.com/djkurlander/knock-knock. Have fun!", "context": "", "use_case": "", "switched_from": "", "story": "Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot"}, {"id": 788385872, "item_id": 49274117, "url": "https://news.ycombinator.com/item?id=49274117", "by": "djkurlander", "date": "2026-08-12", "version": null, "stance": "recommend", "quote": "I run an open source honeypot that collects these botnet scans", "excerpt": "I run an open source honeypot that collects these botnet scans and produces blocklists. Blocklist download and configuration: https://knock-knock.net/blocklist Honeypot dashboard, where you can see attempted attacks in realtime: http://knock-knock.net API: http://knock-knock.net/api", "context": "", "use_case": "Botnet honeypot and blocklists", "switched_from": "", "story": "Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot"}, {"id": 770590368, "item_id": 48161898, "url": "https://news.ycombinator.com/item?id=48161898", "by": "djkurlander", "date": "2026-05-16", "version": null, "stance": "recommend", "quote": "We are using a framework for deploying and displaying honeypot activity", "excerpt": "OP here. See the hidden world of bot attacks and scanner chatter. Listen to Internet Background Radiation on a virtual Geiger counter. Here we are capturing Internet chatter across 8 protocols: (SSH, Telnet, FTP, RDP, SMB, SIP, HTTP, and SMTP), targeting 8 servers distributed throughout the world. Check out the 3D spinning globe heatmap. Explore the most popular usernames and passwords across a variety of protocols. ", "context": "OP of the dashboard", "use_case": "honeypot dashboard", "switched_from": "", "story": "Seeing and Hearing Internet Background Radiation"}, {"id": 766581584, "item_id": 47911349, "url": "https://news.ycombinator.com/item?id=47911349", "by": "djkurlander", "date": "2026-04-26", "version": null, "stance": "neutral", "quote": "", "excerpt": "The goal is to educate people (originally my kids) about one particular aspect of cybersecurity. I love it when people use the site for this purpose. Yep, with ~80 knocks coming in per second and two 3D globe visualizations, it does make a lot of use of the browser. That said, it runs smoothly even on an iPhone browser. The server scales really well (longtime load average of 0.05 on a $6.75/year VPS :-). Thanks!", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Knock-Knock v2 \u2013 Visualizing bot attacks in multi-protocol Technicolor"}, {"id": 766578160, "item_id": 47911135, "url": "https://news.ycombinator.com/item?id=47911135", "by": "djkurlander", "date": "2026-04-26", "version": null, "stance": "recommend", "quote": "OP here. Check out the new https://knock-knock.net.", "excerpt": "OP here. Check out the new https://knock-knock.net. v1 got 40,000+ visits from HN alone, hoping you'll find v2 worth checking out too. Watch bots trying to break into my honeypots, gain access to my files, place expensive VOIP calls, attack my HTTP server, and relay SPAM email. The new knock-knock.net shows you SSH, Telnet, FTP, RDP, SMB, SIP, HTTP, and SMTP attacks in real-time: where they are coming from (check out", "context": "OP", "use_case": "visualizing bot attacks", "switched_from": "", "story": "Show HN: Knock-Knock v2 \u2013 Visualizing bot attacks in multi-protocol Technicolor"}, {"id": 752461728, "item_id": 47028858, "url": "https://news.ycombinator.com/item?id=47028858", "by": "djkurlander", "date": "2026-02-15", "version": null, "stance": "neutral", "quote": "I set up https://amsterdam.knock-knock.net yesterday", "excerpt": "The attempts started almost immediately, but they certainly accelerated over the course of the first few days. Initially, I think it was less than 1 knock per minute, but now it\u2019s over 8. As a comparison, I set up https://amsterdam.knock-knock.net yesterday, and it is now at 2.9 knocks per minute. The bots though scan through all the IPs on the internet, but perhaps they bias certain IPs (local / faster response? On ", "context": "", "use_case": "Visualize server bot scans", "switched_from": "", "story": "Show HN: Knock-Knock.net \u2013 Visualizing the bots knocking on my server's door"}], "threads": [{"url": "https://news.ycombinator.com/item?id=49272569", "title": "Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=47911132", "title": "Show HN: Knock-Knock v2 \u2013 Visualizing bot attacks in multi-protocol Technicolor", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=47025338", "title": "Show HN: Knock-Knock.net \u2013 Visualizing the bots knocking on my server's door", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49662990", "title": "I spent $220 on Google app ads and 60% of the installs were robots", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48643848", "title": "Ask HN: New clean macOS install. Must-have apps? Best browser?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48161894", "title": "Seeing and Hearing Internet Background Radiation", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {"recommend": 1}, "2026-05": {}, "2026-06": {"recommend": 1}, "2026-07": {}, "2026-08": {}, "2026-09": {"recommend": 1}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 794645360, "item_id": 49665335, "url": "https://news.ycombinator.com/item?id=49665335", "by": "mr_mitm", "date": "2026-09-11", "version": null, "stance": "recommend", "quote": "There is https://knock-knock.net/, which is similar", "excerpt": "There is https://knock-knock.net/, which is similar", "context": "", "use_case": "", "switched_from": "", "story": "I spent $220 on Google app ads and 60% of the installs were robots"}, {"id": 788442624, "item_id": 49277664, "url": "https://news.ycombinator.com/item?id=49277664", "by": "djkurlander", "date": "2026-08-12", "version": null, "stance": "recommend", "quote": "You can also see a live view of the ASN/ISP leaderboard by going to https://knock-knock.net", "excerpt": "Yeah, that\u2019s pretty interesting! You can also see a live view of the ASN/ISP leaderboard by going to https://knock-knock.net and choosing ISP from the carousel. That\u2019s ordered by bot transaction count rather than IP count though. It never ceases to amaze me that these ISPs don\u2019t bother to shut down the botnets. They could do so very easily. For example, they could identify the IP address of every bot that hit this ho", "context": "", "use_case": "", "switched_from": "", "story": "Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot"}, {"id": 778331118, "item_id": 48645694, "url": "https://news.ycombinator.com/item?id=48645694", "by": "unmanageduck", "date": "2026-06-23", "version": null, "stance": "recommend", "quote": "Autorun checker: KnockKnock", "excerpt": "Package manager: Nix(alternative to homebrew) https://nixos.org/download/#nix-install-macos Package management: Nix-darwin https://github.com/nix-darwin/nix-darwin Browsers: - Librewolf https://librewolf.net - Tor https://www.torproject.org - Orion https://orionbrowser.com Video downloader: Yt-dlp https://github.com/yt-dlp/yt-dlp Video/audio player: Mpv https://github.com/mpv-player/mpv Video editor: LosslessCut http", "context": "", "use_case": "autorun checking", "switched_from": "", "story": "Ask HN: New clean macOS install. Must-have apps? Best browser?"}, {"id": 766580448, "item_id": 47911278, "url": "https://news.ycombinator.com/item?id=47911278", "by": "Datahenge", "date": "2026-04-26", "version": null, "stance": "recommend", "quote": "Very nice app; great job!", "excerpt": "I love the use of color and the retro-style UI. Your INSTRUCTIONS.md was comprehensive. Appears to be CPU-heavy sometimes in the browser (spiked one of my CPUs to 100%), so could be an opportunity for optimization later. I've often wanted to show my clients how risky their brand-new VPS is without proper firewall configuration. Your Knock-Knock tool would be a great way of helping them visualize that. Very nice app; ", "context": "works with clients on VPS setups", "use_case": "visualizing bot attacks for clients", "switched_from": "", "story": "Show HN: Knock-Knock v2 \u2013 Visualizing bot attacks in multi-protocol Technicolor"}]}