But there are bad actors - bots that try every possible urls and traversals and cross scripting and so on… I see it in our access logs. This cannot be solved otherwise than some greylisting/blacklisting on ISP level. E.g. this is so huge that we have started to block all Chinese inbound traffic. I am sorry for that because Deepseek and other good actors are probably blocked as well but IP rotation made it impossible to filter bad ones only… (and I suppose that DS uses EU or US addresses as well so they shouldn’t be blocked in full).
[–] Bender 1 day ago
[–] sixtyj 1 day ago
I focus on content on our site so blocking part of internet with wordfence was brute but as life has only few thousands of weeks, it was the least I wanted to think about :).
Would you mind to share a source of good IP lists pls?
[–] Bender 1 day ago
LLM's can help you implement iprange into IP list building scripts to keep the lists smaller and more efficient.
[1] - https://github.com/firehol/blocklist-ipsets/
[–] sixtyj 1 day ago
[–] Bender 1 day ago
Before pushing such things to production consider first testing in dev/qa then staging or some canary environment. I use those IP's to determine who gets into a moderator review queue so worst case it just makes more work for me. Consider using those in conjunction with whatever rate limiting capabilities your web server provides first so it is not a hard block in the unlikely event a real customer shows up on one of them.
Indeed, they use an edge SSL Bump proxy that is already bandwidth limited and has to speak real HTTPS.
I do not focus too much on IP addresses but rather the behavior that they can not hide. LLM's can help you spot this behavior. Good LLM vs. Bad LLM. Gemini knows a few tricks but you have to coax it out of them. It seems to not want to overload people with information. That said there are some good IP lists that can be used in blackhole routing tables, nginx geo tables, etc...