[Pool] shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes

Ask Bjørn Hansen ask at ntppool.org
Thu Jan 28 17:38:33 UTC 2016

Hi Luca (and everyone),

I removed those servers yesterday. Brad had been helping look to see if others were doing something similar.

I think the behavior was falling well outside what's reasonably expected from a server operator participating in the pool.

The operator had also been adding the same server multiple times in order to "attract" more traffic which is definitely outside the guidelines.

It's not something we want to support, though being the "connector" between users and volunteer server operators on an protocol without any encryption or authentication we can't pretend there's more control than there is.

I might just be too cynical, but it also feels like something we should come to expect. Anyone who's looked at traffic to an Internet facing IPv4 address have seen much worse.

The NTP pool usage being the source sucks, but in general I am sure we will see more of this as IPv6 usage goes up. Because you can't scan the IPv6 space, there will be some value in "active addresses" so eventually we will see IP addresses traded like other PII data is now. Choose the websites you visit carefully?



More information about the pool mailing list