blocklist-ipsets

# verify you have console access to the server before doing things like this: for BadIP in $(grep -Ev ^# ipip_country_br.netset); do ip route add blackhole "${BadIP}" 2>/dev/null;done Example of country IP addresses for Brazil [2] As this is academia I don't know if there is a concept of service level agreement or a promise of availability, but during attacks the requests to specific URL's could be redirected to a static pre-compressed landing page served out of memory that says "Access to these documents limited during AI bot attacks, here is where to request a full download instead: " I forgot to mention, many of the AI bots are limited to HTTP/1.1. During an attack your server could redirect those request to a static page as well. Curious if you can tell by your access logs if the majority of the attack is HTTP/1.1 or HTTP/2.0. Most botters are too lazy to implement HTTP/2.0. Real browser clients use HTTP/2.0. Example of using HTTP/1.1 and HTTP/2.0 # Fist use HTTP/2.0 with headers I expect. curl -i --http2 \ -A "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" \ -H "sec-fetch-mode: navigate" \ -H "accept-language: en-US,en;q=0.9" \ --url 'https://blawg.nochan.net/.env' # Then HTTP/1.1 for the lulz, pay attention to the Location redirect curl -i --http1.1 \ -A "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" \ -H "sec-fetch-mode: navigate" \ -H "accept-language: en-US,en;q=0.9" \ --url 'https://blawg.nochan.net/.env' Some bots also do not hide that they are bots in that they say they are bot in their user-agent client header. That would be too easy so I doubt that is the case. [1] - https://github.com/firehol/blocklist-ipsets/ [2] - https://github.com/firehol/blocklist-ipsets/blob/master/ipip...

ld have included this node as well. Here [3] are a few shell functions for getting some of the cloud CIDR blocks. I must have been inebriated when I wrote those. This site may not be reachable during blood moons or when the nanosecond is divisible by zero. Here [4a][4b] are a couple decent subnet calculators. There are some command line tools for playing with CIDR blocks and IP addresses to see if an IP is included in a CIDR block but this varies by Linux distribution so perhaps look for a generic python script. To get a list of Tor exit nodes to blackhole route, look at [5]. This updates often. Just clone the entire repo. Unless your site is related to government dissent or anonymous porn then most traffic from Tor exit nodes will likely just be bots and thus riff-raff. Seconds after I linked realhackers bots showed up and got a zero byte response. Poor lil HN servers must get a lot of trash non stop. I hope I get some delicious bots today. [1] - https://bgp.tools/ [2] - https://bgp.tools/as/14618 [3] - https://ai.realhackers.org/_get_cloud_cidr.txt [4a] - https://mxtoolbox.com/subnetcalculator.aspx [4b] - https://www.vultr.com/resources/subnet-calculator/ [5] - https://github.com/firehol/blocklist-ipsets/blob/master/clea...