3 ms·

Creator of tirreno [1] here. While our platform is primarily designed for live, logged-in users, it also works well for bot detection and blocking. We anonymi

Creator of tirreno [1] here. While our platform is primarily designed for live, logged-in users, it also works well for bot detection and blocking. We anonymize IP addresses by replacing the last octet with an asterisk, effectively grouping the same subnet under a single account. You can then use the built-in rule engine to automatically generate blacklists based on specific conditions, such as excessive 500 or 404 errors, brute-force login attempts, or traffic from data center IPs. Finally, you can integrate tirreno blacklist API into your application logic to redirect unwanted traffic to an error page. Bonus: a dashboard [2] is available to help you monitor activity and fine-tune the blacklist to avoid blocking legitimate users. [1] https://github.com/tirrenotechnologies/tirreno https://github.com/tirrenotechnologies/tirreno [2] https://play.tirreno.com/login https://play.tirreno.com/login (admin/tirreno)

reconnecting 1y ago
We also have work in progress to block bots based on publicly available IP ranges through the same dashboard. Any suggestions are welcome.
mindslight 1y ago
> We anonymize IP addresses by replacing the last octet with an asterisk, effectively grouping the same subnet under a single account So as a user, not only do I have to suffer your blockwall's false positives based on "data center IPs" (ie most things that aren't naively browsing from the information-leaking address of a last-mile connection like some cyber-bumpkin). But if I do manage to find something that isn't a priori blocked (or manage to click through 87 squares of traffic lights), I still then get lumped in with completely unrelated address-neighbors to assuage your conscience that you're not building a user surveillance system based on nonconsentually processing personal information. Just please make sure you have enough of a feedback process that your customers can see that they are losing real customers with real dollars.
- reconnecting 1y ago
  You're right, blanket blocking based on IP ranges (like TOR or DC) often creates false positives and punishes privacy-conscious users. Therefore, unlike the traditional way of blocking an IP just because it is from a data center, tirreno suggests using a risk-based system that takes into account dozens or hundreds of rules. As in my example, if the IP is from a data center and creates a lot of 404 errors, send it to a manual review queue or to automatic blocking (not recommended). Personally, I prefer to manually review even bot activity, and tirreno, even if it's not directly designed for bot management, works great for this, especially in cases when bad bots are hidden behind legitimate bot UA's.
  - wincy 1y ago
    I keep forgetting that metacritic just doesn’t work with any VPN I’ve tried, but in a way that’s really annoying (it loads the site then never loads any scores or anything you actually want to see). It’s so annoying.
    - reconnecting 1y ago
      I was literally shocked that one European PaaS blocked all TOR exit nodes for all their clients web resources because of security concerns instead of setting up proper online fraud prevention.
      - deleted 1y ago
        [deleted]
  - yjftsjthsd-h 1y ago
    > Therefore, unlike the traditional way of blocking an IP just because it is from a data center, tirreno suggests using a risk-based system that takes into account dozens or hundreds of rules. If you ban by the /24, that really feels like you're coming back to the previous approach, just with extra steps.
    - reconnecting 1y ago
- nixgeek 1y ago
  Increasing amounts of traffic are flowing through Google VPN if you’re on a Pixel, and on Apple, there is iCloud Private Relay. I’d have thought the address-neighbors issue would be especially likely to catch out these situations? Overly simplistic solutions like this absolutely will actively cost you real customers and real revenue.
  - reconnecting 1y ago
    tirreno has a rule for Private Relay/Starlink IP addresses, which can be configured as either a positive or a negative signal, depending on specific needs. There is a extra cost only if you choose to block users automatically, regardless of the tool used.
dbetteridge 1y ago
How are you dealing with isps moving to cgnat, where an ip could realistically represent hundreds of users?
- reconnecting 1y ago
  > While our platform is primarily designed for live, logged-in users, it also works well for bot detection and blocking. tirreno is designed to work with logged-in users, so all actions are tied to usernames rather than IP addresses. From this perspective, we strongly avoid [1] making any decisions or taking actions based solely on IP address information. [1] https://www.tirreno.com/bat/?post=2025-05-25 https://www.tirreno.com/bat/?post=2025-05-25

reconnecting 1y ago

We also have work in progress to block bots based on publicly available IP ranges through the same dashboard. Any suggestions are welcome.

mindslight 1y ago

> We anonymize IP addresses by replacing the last octet with an asterisk, effectively grouping the same subnet under a single account So as a user, not only do I have to suffer your blockwall's false positives based on "data center IPs" (ie most things that aren't naively browsing from the information-leaking address of a last-mile connection like some cyber-bumpkin). But if I do manage to find something that isn't a priori blocked (or manage to click through 87 squares of traffic lights), I still then get lumped in with completely unrelated address-neighbors to assuage your conscience that you're not building a user surveillance system based on nonconsentually processing personal information. Just please make sure you have enough of a feedback process that your customers can see that they are losing real customers with real dollars.

reconnecting 1y ago
You're right, blanket blocking based on IP ranges (like TOR or DC) often creates false positives and punishes privacy-conscious users. Therefore, unlike the traditional way of blocking an IP just because it is from a data center, tirreno suggests using a risk-based system that takes into account dozens or hundreds of rules. As in my example, if the IP is from a data center and creates a lot of 404 errors, send it to a manual review queue or to automatic blocking (not recommended). Personally, I prefer to manually review even bot activity, and tirreno, even if it's not directly designed for bot management, works great for this, especially in cases when bad bots are hidden behind legitimate bot UA's.
- wincy 1y ago
  I keep forgetting that metacritic just doesn’t work with any VPN I’ve tried, but in a way that’s really annoying (it loads the site then never loads any scores or anything you actually want to see). It’s so annoying.
  - reconnecting 1y ago
    I was literally shocked that one European PaaS blocked all TOR exit nodes for all their clients web resources because of security concerns instead of setting up proper online fraud prevention.
    - deleted 1y ago
      [deleted]
- yjftsjthsd-h 1y ago
  > Therefore, unlike the traditional way of blocking an IP just because it is from a data center, tirreno suggests using a risk-based system that takes into account dozens or hundreds of rules. If you ban by the /24, that really feels like you're coming back to the previous approach, just with extra steps.
  - reconnecting 1y ago
nixgeek 1y ago
Increasing amounts of traffic are flowing through Google VPN if you’re on a Pixel, and on Apple, there is iCloud Private Relay. I’d have thought the address-neighbors issue would be especially likely to catch out these situations? Overly simplistic solutions like this absolutely will actively cost you real customers and real revenue.
- reconnecting 1y ago
  tirreno has a rule for Private Relay/Starlink IP addresses, which can be configured as either a positive or a negative signal, depending on specific needs. There is a extra cost only if you choose to block users automatically, regardless of the tool used.

dbetteridge 1y ago

How are you dealing with isps moving to cgnat, where an ip could realistically represent hundreds of users?

reconnecting 1y ago
> While our platform is primarily designed for live, logged-in users, it also works well for bot detection and blocking. tirreno is designed to work with logged-in users, so all actions are tied to usernames rather than IP addresses. From this perspective, we strongly avoid [1] making any decisions or taking actions based solely on IP address information. [1] https://www.tirreno.com/bat/?post=2025-05-25 https://www.tirreno.com/bat/?post=2025-05-25