Someone shared this cool site on Hacker News: https://knock-knock.net/.

It’s a honey pot with the purpose of identifying malicious actors on the internet and then publicly sharing the list of their IP addresses.

Since I’m hosting my own site, I’ve seen how many bots are hitting my poor server. Number one on the list of 404 errors is a request to /wp-admin/install.php?step=1 – 10 times as many hits as the next entry. It’s clearly an attempt to pwn web servers whose careless admins left an uninitialized WordPress instance exposed to the internet.

Perhaps some of these actors are benign and do this simply to warn webmasters, but I don’t really want this traffic, so I’m going to try this out. I like its elegance. Setting it up is dead simple: https://knock-knock.net/blocklist

Except I experienced an issue. The script threw an error:

ipset v7.22: Hash is full, cannot add more elements

By reading the manpage like it’s 2021 we learn that the default maximum size, which we can increase using the maxelem argument, is 65536. Not enough. Let’s set it to 1048576:

#!/bin/bash
# See https://knock-knock.net/blocklist

URL=https://knock-knock.net/static/ip-blocklist-year.txt
ipset create knockknock hash:ip -exist maxelem 1048576
ipset create knockknock_tmp hash:ip -exist maxelem 1048576; ipset flush knockknock_tmp
curl -sf "$URL" | sed 's/^/add knockknock_tmp /' | ipset restore -exist
ipset swap knockknock_tmp knockknock
ipset destroy knockknock_tmp

# add the DROP rule only if it's not already present (so re-running is harmless):
iptables -C INPUT -m set --match-set knockknock src -j DROP 2>/dev/null \
  || iptables -I INPUT -m set --match-set knockknock src -j DROP

Save this to /usr/local/bin/knock-knock.sh, make it executable and add it as a cronjob and we’re done:


chmod +x /usr/local/bin/knock-knock.sh
ln -nfs /usr/local/bin/knock-knock.sh /etc/cron.daily/

(This is assuming a Debian system where curl, iptables and ipset are installed.)