Am Do den 1. Okt 2026 um 20:24 schrieb John Levine via mailop: > What's strange is that while in the past it was typically from a few > ill-behaved Chinese networks, now it's literally from everywhere. I've > taken the IP addresses from the logs, found the network for each > IP and did a packet-level block against the network. So far > I've blocked over 1200 networks and every time I run the script, > it finds a few more new networks. This has gotten the attack > rate down to something I can handle, but it's weird.
That is usually the pattern of AI bots running on client machines browser without the knowledge of the users. I seen that often in the past but mostly in my web log. The strange is that every IP is used just once. I implemented go-away for that and it issues a token that is used just a second later from a complete different IP in the world. Saying that, there is no way to reliable block that ill behaving AI clients. You can handle it somehow on website with go-away but that is protocol specific. If you go on with blocking everything, you will end up having all dialup networks blocked. What sometime helped for me was to block all Brazil hosts. But that was month ago and they behave ok present time. Gruß Klaus -- Klaus Ethgen http://www.ethgen.ch/ pub 4096R/4E20AF1C 2011-05-16 Klaus Ethgen <[email protected]> Fingerprint: 85D4 CA42 952C 949B 1753 62B3 79D0 B06F 4E20 AF1C
signature.asc
Description: PGP signature
_______________________________________________ mailop mailing list [email protected] https://list.mailop.org/listinfo/mailop
