Re: Chinese downloads overloading my website

On Tue, 12 Mar 2024 09:41:00 +0000, Martin Brown
<'''newspam'''@nonad.co.uk> wrote:

On 11/03/2024 16:57, legg wrote:

On Mon, 11 Mar 2024 07:48:04 -0700, Don Y
<blockedofcourse@foo.invalid> wrote:
 

On 3/11/2024 7:40 AM, legg wrote:

Blocking a single IP hasn't worked for my ISP.

>
It won't.  Even novice users can move to a different IP using reeadily
available mechanisms.
>
Whitelisting can work (which is the approach that I use) but
it assumes you know who you *want* to access your site.
>
(It's a lot harder to guess a permitted IP than it is to avoid
an obviously BLOCKED one!)
>

Each identical 17G download block (262 visits)was by a new IP
in a completely different location/region.
>
Beijing, Hearbin, Henan, a mobile and a fifth, so far untraced
due to suspension of my site.

>
There's a reason things like "captcha" exist.
>
Note that this still doesn't prevent the *page(s)* from being repeatedly
accessed.  But, presumably, their size is considerably smaller than
that of the payloads you want to protect.
>
OTOH, if someone wants to shut down your account due to an exceeded
quota, they can keep reloading those pages until they've eaten up your
traffic quota.  And, "they" can be an automated process!
>
[Operating a server in stealth mode can avoid this.  But, then
you're not "open to the public"!  :> ]

 
Doing some simple experiments by temporarily renaming/replacing
some of the larger files being tageted, just to see how the bot
reacts to the new environment. If they find renamed files it
means something. If visits to get the same 17G alter it means
something else.
 
This all at the expense and patience of my ISP. Thumbs up there.

>
Why don't you block entire blocks of Chinese IP addresses that contain
the ones that have attacked you until the problem ceases?
eg. add a few banned IP destinations to your .htaccess file
>
https://htaccessbook.com/block-ip-address/
>
1.80.*.* thru 1.95.*.*
101.16.*.* thru 101.16.*.*
101.144.*.* thru 101.159.*.*
>
If you block just a few big chunks it should make some difference.
You might have to inflict a bit of collateral damage in the 101.* range.
>
Otherwise you are stuck with adding some Captcha type thing to prevent
malicious bots hammering your site. I'm a bit surprised that your ISP
doesn't offer or have site wide countermeasures for such DOS attacks.

My ISP has blocked all China IP addresses from accessing the
site.

Maybe that's what the bots want; who knows?

Haven't had access to the site to find out what the practical result
was, yet, or what the final probing looked like. Whatever it was, it
didn't result in another 17G block download, before the automated
account suspension reasserted itself, which was the last case
examined. (went 14G overlimit for full 17G load).

RL