Ban me at the IP level if you don't like me • Hacker News Board

Re: Ban me at the IP level if you don't like me

#181

Post by nkrisc » Mon, Aug 25, 2025, 9:51 AM UTC

johnisgood wrote: post #123

sugarpimpdorsey wrote: post #38

Earlier quoted context omitted.

There's some weird ones you'd never think of that originate an inordinate amount of bad traffic. Like Seychelles. A tiny little island nation in the middle of the ocean inhabited by... bots apparently? Cyprus is another one. Re: China, their cloud services seem to stretch to Singapore and beyond. I had to blacklist all of Alibaba Cloud and Tencent and the ASNs stretched well beyond PRC borders.

[flagged]

People get weird when you do what you want with your own things.

Want to block an entire country from your site? Sure, it’s your site. Is it fair? Doesn’t matter.

Re: Ban me at the IP level if you don't like me

#182

Post by poisonborz » Mon, Aug 25, 2025, 9:52 AM UTC

Jnr wrote: post #175

Externally I use Cloudflare proxy and internally I put Crowdsec and Modsecurity CRS middlewares in front of Traefik. After some fine-tuning and eliminating false positives, it is running smoothly. It logs all the temporarily banned and reported IPs (to Crowdsec) and logging them to a Discord channel. On average it blocks a few dozen different IPs each day. From what I see, there are far more American IPs trying to ac…

Crowdsec: the idea is tempting, but giving away all of the server's traffic to a for-profit is a huge liability.

Re: Ban me at the IP level if you don't like me

#183

Post by motorest » Mon, Aug 25, 2025, 9:52 AM UTC

lxgr wrote: post #31

lwansbrough wrote: post #17

We solved a lot of our problems by blocking all Chinese ASNs. Admittedly, not the friendliest solution, but there were so many issues originating from Chinese clients that it was easier to just ban the entire country. It's not like we can capitalize on commerce in China anyway, so I think it's a fairly pragmatic approach.

Why stop there? Just block all non-US IPs! If it works for my health insurance company, essentially all streaming services (including not even being able to cancel service from abroad), and many banks, it’ll work for you as well. Surely bad actors wouldn’t use VPNs or botnets, and your customers never travel abroad?

> Why stop there? Just block all non-US IPs!

This is a perfectly good solution to many problems, if you are absolutely certain there is no conceivable way your service will be used from some regions.

> Surely bad actors wouldn’t use VPNs or botnets, and your customers never travel abroad?

Not a problem. Bad actors which are motivated enough to use VPNd or botnets are a different class of attacks that have different types of solutions. If you eliminate 95% of your problems with a single IP filter them you have no good argument to make against it.

Re: Ban me at the IP level if you don't like me

#184

Post by lexicality » Mon, Aug 25, 2025, 9:53 AM UTC

that_lurker wrote: post #99

Why not just block the User Agent?

because you have to parse the http request to do that, while blocking the IP can be done at the firewall

Re: Ban me at the IP level if you don't like me

#185

Post by johnisgood » Mon, Aug 25, 2025, 9:54 AM UTC

lmz wrote: post #179

johnisgood wrote: post #123

Earlier quoted context omitted.

[flagged]

> be a hero and die a martyr I believe it's "an hero".

Oh thank you kind sir.

Re: Ban me at the IP level if you don't like me

#186

Post by BoredPositron » Mon, Aug 25, 2025, 9:54 AM UTC

ruszki wrote: post #139

yupyupyups wrote: post #43

Earlier quoted context omitted.

And that's perfectly fine. Nothing is completely bulletproof anyway. If you manage to get rid of 90% of the problem then that's a good thing.

Okay, but this causes me about 90% of my major annoyances. Seriously. It’s almost always these stupid country restrictions. I was in UK. I wanted to buy a movie ticket there. Fuck me, because I have an Austrian ip address, because modern mobile backends pass your traffic through your home mobile operator. So I tried to use a VPN. Fuck me, VPN endpoints are blocked also. I wanted to buy a Belgian train ticket still fr…

The vpn is probably your problem there mate.

Re: Ban me at the IP level if you don't like me

#187

Post by poisonborz » Mon, Aug 25, 2025, 9:57 AM UTC

Naive question: why isn't there a publicly accessible central repository of bad IPs and domains, stewarded by the industry, operated by a nonprofit, like W3C? Yes it wouldn't be enough by itself ("bad" is a very subjective term) but it could be a popular well-maintained baseline.

Re: Ban me at the IP level if you don't like me

#188

Post by timpera » Mon, Aug 25, 2025, 9:57 AM UTC

As someone who uses VPNs all the time, these comments make me sad. Blocking by IP is not the solution.

Re: Ban me at the IP level if you don't like me

#189

Post by herbst » Mon, Aug 25, 2025, 9:57 AM UTC

devoutsalsa wrote: post #67

herbst wrote: post #62

More than half of my traffic is Bing, Claude and for whatever reason the Facebook bots. None of these are main main traffic drivers, just the main resource hogs. And the main reason when my site turns slow (usually an AI, microsoft or Facebook ignoring any common sense) China and co is only a very small portion of my malicious traffic. Gladly. It's usually US companies who disrespect my robots.txt and DNS rate limits…

There are a lot of dumb questions, and I pose all of them to Claude. There's no infrastructure in place for this, but I would support some business model where LLM-of-choice compensates website operators for resources consumed by my super dumb questions. Like how content creators get paid when I watch with a YouTube Premium subscription. I doubt this is practical in practice.

For me it looks more like out of the control bots than average requests. For example a few days ago I blocked a few bots. Google was about 600 requests in 24 hours. Bing 1500, Facebook is mostly blocked right now, Claude with 3 different bot types was about 100k requests in the same time.

There is no reason to query all my sub-sites, it's like a search engine with way to many theoretical pages.

Facebook also did aggressively, daily indexing of way to many pages, using large IP ranges until I blocked it. I get like one user per week from them, no idea what they want.

And bing, I learned, "simply" needs hard enforced rate limits it kinda learns to agree on.

Re: Ban me at the IP level if you don't like me

#190

Post by JdeBP » Mon, Aug 25, 2025, 9:57 AM UTC

firefoxd wrote: post #26

Since I posted an article here about using zip bombs [0], I'm flooded with bots. I'm constantly monitoring and tweaking my abuse detector, but this particular bot mentioned in the article seemed to be pointing to an RSS reader. I white listed it at first. But now that I gave it a second look, it's one of the most rampant bot on my blog. [0]: https://news.ycombinator.com/item?id=43826798

One of the few manual deny-list entries that I have made was not for a Chinese company, but for the ASes of the U.S.A. subsidiary of a Chinese company. It just kept coming back again and again, quite rapidly, for a particular page that was 404. Not for any other related pages, mind. Not for the favicon, robots.txt, or even the enclosing pseudo-directory. Just that 1 page. Over and over.

The directory structure had changed, and the page is now 1 level lower in the tree, correctly hyperlinked long since, in various sitemaps long since, and long since discovered by genuine HTTP clients.

The URL? It now only exists in 1 place on the WWW according to Google. It was posted to Hacker News back in 2017.

(My educated guess is that I am suffering from the page-preloading fallout from repeated robotic scraping of old Hacker News stuff by said U.S.A. subsidiary.)