upvote

points

by Bender4 hours ago |
comments
upvoteby codegeek3 hours ago|
next
[-]
Is there an easy way to block any requests originating from VPS etc instead of residential/commercial IP from legitimate users ? I know cloudflare does a few things but I really want to figure out a way to block any request say at nginx or caddy (reverse proxy) from reaching origin servers if they are not from an IP that is not a VPS etc.
reply
upvoteby djkurlander2 hours ago|
parent|
next
[-]
I run an open source honeypot that collects these botnet scans and produces blocklists.

Blocklist download and configuration: https://knock-knock.net/blocklist

Honeypot dashboard, where you can see attempted attacks in realtime: http://knock-knock.net

API: http://knock-knock.net/api

reply
upvoteby Bender56 minutes ago|
parent|
prev|
next
[-]
There are several methods. [1] The most aggressive method-02 and method-03 on my document will block VPS and some data-centers but that also means it will block some legit users that are on a VPN. Most VPNs transit a data-center. If experimenting with these methods use a test server that you do not care about and set up a dummy site and ask people in your circle of friends to test it. I have to step away for a bit but if you have questions I will try to answer.

[1] - https://nochan.net/b/Internet-Crap/20260606-How-To-Block-Som...

reply
upvoteby nubinetwork16 minutes ago|
parent|
next
[-]
Per your link...

> block http 1.1, real users only use 2.0

Chrome on android and Firefox on linux both appear to use 1.1 still...

reply
upvoteby VogonPoetry35 minutes ago|
parent|
prev|
[-]
Your site does not currently seem to be reachable / responsive when I try to reach it from a US Comcast IPv4 address - you are not advertising IPv6.

Edit / Update: It was Apple's Private browsing mode that causes it not to respond. I can now see it when this is disabled.

reply
upvoteby basilikum2 hours ago|
parent|
prev|
next
[-]
> /commercial IP from legitimate users

No, because legitimate users do not just use residential and "commercial" IPs. Like me, right now

reply
upvoteby VladVladikoff2 hours ago|
parent|
[-]
You are the 0.001%
reply
upvoteby basilikum2 hours ago|
parent|
[-]
Much more than 0.001% of people care about their privacy or (the larger portion) do not have unfiltered access to the internet.
reply
upvoteby Bender55 minutes ago|
parent|
[-]
I second this. When I have tested blocking VPS/data-centers to my silly blog there were about a dozen people on HN [1] that could not view my site out of the roughly ~17,000 (not counting bots) that could. It's not a big number but those are real people and they count.

I am going to move full blocking to a test node that people can play with but I have to finish working with Claude to revise someones repo is is no longer maintained because one does not simply put an anonymous chan board on the great wide open internets without some critical thinking.

[1] - https://news.ycombinator.com/item?id=49060945

reply
upvoteby VladVladikoff2 hours ago|
parent|
prev|
[-]
Yes but it’s not cheap. Maxmind and ipinfo etc sell a tier that tells you this information, then you can 403 based on it. But the price is nuts like $40,000 a year.
reply
upvoteby yardstick48 minutes ago|
parent|
next
[-]
Open source works just fine for this - take a look at geoacumen-country

https://github.com/geoacumen/geoacumen-country

reply
upvoteby reincoder1 hours ago|
parent|
prev|
next
[-]
I work for IPinfo. We offer IPinfo Lite for free. With a little bit of time in identifying the ASNs, you can implement a decent way to block a good number of bots fairly easily using the free data alone.
reply
upvoteby gavinhking1 hours ago|
parent|
[-]
Good to know, thank you. Would you do this by fully blocking particular ASNs? Or something more granular?
reply
upvoteby reincoder36 minutes ago|
parent|
[-]
You can block entire ASNs. If you are frustrated with bots, blocking Tencent's entire IP address space would have very few downsides.

If you have fail2ban or NGINX logs, you can use our CLI to summarize those IPs and identify the ASNs you want to block. But before you block entire ASNs, make sure they are not classified as "ISP" type. For that, visit our website's ASN page first.

I have quite a few community posts around this approach. https://community.ipinfo.io/

If you have raw logs, you can send them to me as well, and I can review them and provide some guidance.

reply
upvoteby KomoD2 hours ago|
parent|
prev|
next
[-]
You don't need to spend anywhere near $40k a year to get that info... You don't even need to spend $1
reply
upvoteby gavinhking1 hours ago|
parent|
[-]
What's your strategy?
reply
upvoteby sparkling1 hours ago|
parent|
prev|
[-]
Focsec.com IP database for offline use (datacenters, VPNs, proxies, bots) runs around $1k/month for internal-only use.
reply
upvoteby gavinhking3 hours ago|
prev|
next
[-]
Yeah, that's exactly what these visits are: faked user agents that fail IP verification or Web Bot Auth. What's interesting is the surge across so many websites in the last week.
reply
upvoteby Bender3 hours ago|
parent|
[-]
There are many possibilities but one of them could be some new vuln was released and they are looking for it. That would require looking at the URL's they are requesting. Botters run their own purpose built campaigns. Do you also have a summary of URL's requested by unique counts?
reply
upvoteby gavinhking3 hours ago|
parent|
[-]
Looks like many of the paths relate to AI coding tools. There are some examples below the chart
reply
upvoteby hluska2 hours ago|
parent|
[-]
You keep repeating this about a small minority of the tools that were posted.
reply
upvoteby bflesch3 hours ago|
prev|
[-]
Same for the origin IP address. The fiber leaving your country is tapped, and those people can inject packets with any origin IP that they want. Your ISP has no way to check if their peer actually received a certain packet from a certain country or not.

From a technical perspective, all this "china/russia" attribution is built on a quite shaky foundation. As a sysadmin you'd never know if it would be the British crown attacking your European company instead.

Not minimizing nation state cyber crime here, but the packet goes through many hands with different incentives.

reply
upvoteby pixl972 hours ago|
parent|
[-]
Problem here is there are not single fibers attaching (most) countries, but a bunch of them. If you control both the ingress and egress for some particular users it's possible, but if you don't then your probing packing may end up back in China with a lot of evidence of backscatter.
reply
upvoteby bflesch1 hours ago|
parent|
[-]
I'd be surprised if there is a single route from EU to non-EU countries which does not pass through British control.
reply