I've set up a site on Digital Ocean without a domain yet, so there is only the IP. Despite telling no-one of its existence or advertising it, I get hundreds of notices from fail2ban that various IP's are trying to hack my SSL port or are looking for PHP files.

But how do they know that I do exist? Where do they get the IP from?

  • 154
    Welcome to the Internet! They do round the clock scans of the whole public IPv4 address space. Wouldn't call 'em kiddies though. Commented Feb 12, 2016 at 12:57
  • 8
    You'll notice this happen very fast, basically within minutes of going online. It only gets worse, especially if you're hosting a high value target. You can alleviate this to a degree by installing xtables geoip addons and using a negation match, allowing only specific countries (highest traffic comes from China, Brazil, Russia etc). Note that all this does though is cut down the bot traffic and cut down the work your CPU has to do banning these scans/automated attacks. This alone doesn't secure you at all.
    – user7933
    Commented Feb 12, 2016 at 13:50
  • 2
    @Carcigenicate Are you even reachable? That is, public ip, port forwarding etc.?
    – deviantfan
    Commented Feb 12, 2016 at 17:00
  • 9
    randint(1,255):randint(1:255):randint(1:255):randint(1:255) will hit you, eventually.
    – Davidmh
    Commented Feb 13, 2016 at 16:39
  • 2
    It is like asking, how did the postman find your house so he was able to throw the flyer in your mail box which he throw in every mailbox in your neighborhood.
    – Zaibis
    Commented Feb 15, 2016 at 15:40

6 Answers 6


You can't hide your IP address on the internet. They aren't secret.

Pretty much what @DeerHunter said. It's trivial to scan the entire internet. If they want, they can target all-known digital ocean droplets that are online.

They can do this on a timer so that when you go offline, or online, it will just keep trying as those may be high-value targets that could become vulnerable at a moment's notice.

Let me give you a very rough coding example. Let's pretend your IP address is Let's get the IP address of www.digitalocean.com so we can easily check for associated IP addresses. www.digitalocean.com returns Let's scan everything: 104.16.25.*

Scanning is incredibly easy from a programming standpoint

Let's assume we want to try and find all nearby associated IP addreses. Assume programs can handle numbers and patterns very well. Here's an example of an integer being incremented:


This increments the current value of i by 1. Let's assume i starts off as 1. After i++, you'll get 2. Check out this painfully simple loop:

for (int i = 1; i < 256; i++)
    scanIpAddress("104.16.25." + i);

An alternative one-line bash variant would be as follows:

for ip in `seq 1 255`; do scan_thingy_command 192.168.0.$ip --options -oG lol.txt; done

You just scanned, and changed i from 0 to 1. As the whole loop continues, it will go from to I don't have time to scan and look right now, however, it's possible that this tiny block doesn't just belong to digitalocean.

To find more targets on DigitalOcean, a programmer may change the numbers even more. For example, introduce another loop that nests the aforementioned loop on the inside, and add j: scanIpAddress("104.16." + j + "." + i);. This will allow them to scan 104.16.1-255.1-255.

From there, they can keep going backwards and nesting for loops until they get the entire internet. There are other, more efficient ways to do this, such as masscan, but this is the most basic way.

Again, this could also be done on the command line with one line:

for oct1 in `seq 1 255`; do for oct2 in `seq 1 255`; do for oct3 in `seq 1 255`; do for oct4 in `seq 1 255`; do scan $oct1.$oct2.$oct3.$oct4 --stuff; done; done; done; done 

Other methods

The above example was a really rough example. They may be doing more, their code might be different, and they may be using entirely different methods and/or programs. However, the concept is pretty much the same.

It's also possible that the programs in question are just targeting everyone en masse.

So how can I hide my stuff online?

If it's online, whatever you are hiding, they will find it... or try to find it.

However, depending on your web server, you can try http access controls such as .htaccess. If you're using access controls - again, this depends on your web server - then it's likely that you'll be able to prevent others from viewing/accessing pages.

That won't protect you against non-website login attempts, though. And if you're denying them access to non-existent webpages, they now know you're really online, and can focus their attacks more easily! However, it's still good practice.

Here's an example .htaccess deny for Apache (2.4 and later):

Require ip

In the above example, you're denying everyone access to that folder, except your IP address. Keep in mind, is a local IP address. You'll have to replace that with your public IP address.

Also, keep in mind that if your attacker is running a proxy/VPN on your machine, they can still access those pages. If your attacker already has access to the website, they can either edit the .htaccess or remove it. Nothing's 100%.

Just don't put anything online if you aren't ready to be scanned. Everyone has a plan until they get port-scanned in the mouth.

  • 37
    @TechnikEmpire Buffalo overflow attack. Commented Feb 12, 2016 at 14:01
  • 38
    @MarkBuffalo I thought the Buffalo Overflow Attack is "Buffalo buffalo buffalo Buffalo buffalo buffalo Buffalo buffalo buffalo buffalo buffalo Buffalo buffalo Buffalo buffalo buffalo Buffalo buffalo buffalo Buffalo buffalo buffalo buffalo buffalo Buffalo buffalo Buffalo buffalo buffalo Buffalo buffalo buffalo Buffalo buffalo buffalo buffalo buffalo Buffalo buffalo Buffalo buffalo buffalo Buffalo buffalo buffalo Buffalo buffalo buffalo Buffalo buffalo Buffalo buffalo Buffalo buffalo buffalo Buffalo buffalo buffalo Buffalo buffalo buffalo buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo."
    – corsiKa
    Commented Feb 12, 2016 at 17:13
  • 44
    @corsiKa Please take this off-topic discussion to BuffaloOverflow.stackexchange.com. Commented Feb 12, 2016 at 18:30
  • 7
    noone thought of 'Buffaloverflow'? edit: I have now secured trademark rights on that name. Pay up!
    – DrewJordan
    Commented Feb 12, 2016 at 19:54
  • 6
    To find all Digital Ocean IPs, you just need to check the AS number listings. You want to look at AS14061 Digital Ocean, Inc..
    – Riking
    Commented Feb 12, 2016 at 22:58

The IPv4 address space is limited to only 4,294,967,296 addresses.[note 1] Given enough bandwidth, it becomes trivial to scan every single IP address out there, especially if you're the owner of a botnet consisting of thousands of hacked devices.

With IPv6[note 2], things are a bit more tricky: with over 300,000,000,000,000,000,000,000,000,000,000,000,000 addresses, it becomes impractical to enumerate them all. However, there are still various means by which the addresses can be discovered; for example, in a recent case Internet-of-Things search engine Shodan was caught using NTP servers to discover new IPv6 hosts when they synchronized their clocks.

The gist of this: if you're not ready to be probed, you shouldn't be on the internet. Scanning the entire IPv4 internet can be done in a matter of days, and your IPv6 address will get discovered as well – unless you are not using it at all.

Note 1: Some of these are not available because they have been reserved for special purposes.
Note 2: IPv6 is only available for Digital Ocean users when they have enabled it.

  • 38
    +1 for "if you're not ready to be probed, you shouldn't be on the internet'
    – Lilienthal
    Commented Feb 12, 2016 at 17:17
  • 1
    @Mason Yes, I should probably clarify that you'll need a lot of bandwidth for your servers (or a really big botnet) for that. Edit: changed it to "days" and added a link to an example to the post. Commented Feb 12, 2016 at 22:00
  • 1
    technically you could just rent a huge rig for scanning for the day.
    – Oscalation
    Commented Feb 13, 2016 at 3:52
  • 6
    @MasonWheeler waitaminute, that 200 days is if you did each request in serial, which is kinda nuts. Simply using background processes or something, I'd think you can do at least 200 requests simultaneously without much degradation in latency, so a complete ipv4 scan would take 1 computer 1 day, not 200 days. And maybe a lot better than that even, not sure about exact numbers at the moment.
    – Don Hatch
    Commented Feb 13, 2016 at 4:53
  • 2
    @MasonWheeler It is not hard to get yourself a server with 1Gbit/s of connectivity. Most network paths have a PMTU of 1500 bytes or a little less than that. In order to be able to use the bandwidth it means the equipment must be able to handle at least 83333 packets per second. There are about 3700 million global unicast addresses in IPv4. Sending one packet to each of them at that speed takes 12 hours and 20 minutes.
    – kasperd
    Commented Feb 13, 2016 at 11:21

But how do they know that I do exist?

They don't know that you exist. They don't know they're talking to you: they just know they're talking to a computer with a particular IP address. IP addresses are a lot like phone numbers. If you dial a legitimate area code followed by a random number with the right number of digits, there's a decent chance you'll get to speak to somebody, especially if the area code has many subscribers. That doesn't mean you "knew that person exists": it just means that you found out that their phone number is connected.

Where do they get the IP from?

They don't get it from anywhere. It's just a 32-bit number and there aren't really so many of those. there, that's an IP address. I got it by mashing my keyboard (and deleting invalid digits). It probably belongs to somebody because almost all IP addresses do. The bad guys just systematically scan the address space; they'll find any IP address because "finding" just means "generating enough valid numbers".


But how do they know that I do exist?

They know that something exists on that IP address because their scanner is telling them so. Most likely they didn't come looking for you, they just stumbled across that IP address by scanning large chunks, or the entire internet.


  1. IP addresses are finite.
  2. IP addresses are assigned in blocks.

So you can scan all IPs from your home PC in about a year, although your ISP might notice and ask you what you're trying to pull. Some blocks are more likely to contain poorly protected servers, specifically the blocks assigned to hosting providers. Scanning only these blocks is very cheap, fast, and easy, and the likelihood of success is comparatively high.

Scanning from a single IP is problematic, because your IP will get blocked soon, so these people use botnets, or the commercial equivalent: cloud services. You don't need to build your own botnet. Instead you can rent a botnet.

  • 1
    Many security experts simply ignore all the scans as " background noise," so it won't necessarily get them blocked. Commented Feb 14, 2016 at 14:14

Most likely they don't know that the given IP belongs to you in particular. But they do know the IP pool which belongs to your hosting company and they use that information to scan for active hosts. You can use iptables to improve the security of your box, or to limit the number of connection and connections types but other than that there is nothing else you can do. The internet was meant to be used to share information. If you don't want to share just disconnect the box (development box). If it is a development box it would be a good idea to move it locally and provide no access to it outside of your LAN.

  • They almost certainly don't know that the block of addresses belongs to anyone in particular, because that information is almost certainly of no use to them. It's most likely not a targeted attack. Commented Nov 20, 2016 at 11:13
  • An attack is always targeted. The only question is towards who or what.
    – user100251
    Commented Nov 21, 2016 at 11:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .