I really ought to do something like this rather than just allowing our logs to endlessly fill with requests for wp-admin.
replyAnother version if this if the 301 is too much is to just close the connection then have a daemon or cron job shove their IP into a NFTables ipset or blackhole route them. Be sure to have exclusion elements so one can not block their own gateway or corporate SNAT groups.
reply location ~* /(xmlrpc|wp-login\.php|wp-admin) { set $ban 1; return 444 ''; }
# grep banip /etc/nginx.conf
log_format banip '$remote_addr';
# grep banip /etc/nginx/http.d/some-server.conf
access_log /var/log/nginx/ban.log banip if=$ban;<send friend request>
replyThere are different kinds of bots. The ones of interest that would have been using Yandex are those that post political comments or misinformation on social media sites. Bots that are just trying generic hacks are more likely to be much more widely distributed, because not every country is trying to hack the US psyche.
replyThe ones of interest that would have been using Yandex are those that post political comments or misinformation on social media sites.
replyFor those bots I put their networks into an nginx geo file along with detecting other characteristics and set a variable that tells my app to allow them to post, but all their posts go into a moderator review queue. Some use residential proxies but I've learned how to automatically detect the never-before-seen residential proxies almost instantly now even when they are properly instrumenting Headless Chrome. Only I see Статуя Свободы мертва.