7 ms·

We solved a lot of our problems by blocking all Chinese ASNs. Admittedly, not the friendliest solution, but there were so many issues originating from Chinese c

We solved a lot of our problems by blocking all Chinese ASNs. Admittedly, not the friendliest solution, but there were so many issues originating from Chinese clients that it was easier to just ban the entire country. It's not like we can capitalize on commerce in China anyway, so I think it's a fairly pragmatic approach.

lxgr 1y ago
Why stop there? Just block all non-US IPs! If it works for my health insurance company, essentially all streaming services (including not even being able to cancel service from abroad), and many banks, it’ll work for you as well. Surely bad actors wouldn’t use VPNs or botnets, and your customers never travel abroad?
- lwansbrough 1y ago
  Don't care, works fine for us.
  - yupyupyups 1y ago
    And that's perfectly fine. Nothing is completely bulletproof anyway. If you manage to get rid of 90% of the problem then that's a good thing.
    - lxgr 1y ago
      And if your competitor manages to do so without annoying the part of their customer base that occasionally leaves the country, everybody wins!
      - yupyupyups 1y ago
        Fair point, that's something to consider.
    - ruszki 1y ago
      Okay, but this causes me about 90% of my major annoyances. Seriously. It’s almost always these stupid country restrictions. I was in UK. I wanted to buy a movie ticket there. Fuck me, because I have an Austrian ip address, because modern mobile backends pass your traffic through your home mobile operator. So I tried to use a VPN. Fuck me, VPN endpoints are blocked also. I wanted to buy a Belgian train ticket still from home. Cloudflare fuck me, because I’m too suspicious as a foreigner. It broke their whole API access, which was used by their site. I wanted to order something while I was in America at my friend’s place. Fuck me of course. Not just my IP was problematic, but my phone number too. And of course my bank card… and I just wanted to order a pizza. The most annoying is when your fucking app is restricted to your stupid country, and I should use it because your app is a public transport app. Lovely. And of course, there was that time when I moved to an other country… pointless country restrictions everywhere… they really helped. I remember the times when the saying was that the checkout process should be as frictionless as possible. That sentiment is long gone.
      - lwansbrought 1y ago
        [dead]
      - BoredPositron 1y ago
        The vpn is probably your problem there mate.
        ruszki 1y ago
        I don’t use VPN generally, only in specific cases. For example, when I want to reach Australian news. Because of course, as a non Australian, I couldn’t care about local news. Or when American pages rather ban Europe than they would tell who they sell my data to.
        Dylan16807 1y ago
        They tried a VPN as a backup for one of those problems. So no. It's not.
      - sarchertech 1y ago
  - Nemi 1y ago
    Worked great for us, but I had to turn it off. Why? Because the IP databases that the two services I was using are not accurate enough and some people in the US were being blocked as if they had a foreign IP address. It happened regularly enough I reluctantly had to turn it off and now I have to deal the non-stop hacking attempts on the website. For the record, my website is a front end for a local-only business. Absolutely no reason for anyone outside the US to participate.
- raffraffraff 1y ago
  And across the water, my wife has banned US IP addresses from her online shop once or twice. She runs a small business making products that don't travel well, and would cost a lot to ship to the US. It's a huge country with many people. Answering pointless queries, saying "No, I can't do that" in 50 different ways and eventually dealing with negative reviews from people you've never sold to and possibly even never talked to... Much easier to mass block. I call it network segmentation. She's also blocked all of Asia, Africa, Australia and half of Europe. The blocks don't stay in place forever, just a few months.
  - silisili 1y ago
    Google Shopping might be to blame here, and I don't at all blame the response. I say that because I can't count how many times Google has taken me to a foreign site that either doesn't even ship to the US, or doesn't say one way or another and treat me like a crazy person for asking.
  - lxgr 1y ago
    As long as your customer base never travels and needs support, sure, I guess. The only way of communicating with such companies are chargebacks through my bank (which always at least has a phone number reachable from abroad), so I’d make sure to account for these.
    - closewith 1y ago
      Chargebacks aren't the panacea you're used to outside the US, so that's a non-issue.
      - lxgr 1y ago
        Only if your bank isn't competent in using them. Visa/Mastercard chargeback rules largely apply worldwide (with some regional exceptions, but much less than many banks would make you believe).
        closewith 1y ago
- silisili 1y ago
  I'm not precisely sure the point you're trying to make. In my experience running rather lowish traffic(thousands hits a day) sites, doing just that brought every single annoyance from thousands per day to zero. Yes, people -can- easily get around it via various listed methods, but don't seem to actually do that unless you're a high value target.
  - lxgr 1y ago
    It definitely works, since you’re externalizing your annoyance to people you literally won’t ever hear from because you blanket banned them based. Most of them will just think your site is broken.
    - aspenmayer 1y ago
      It seems to be a choice they’re making with their eyes open. If folks running a storefront don’t want to associate with you, it’s not personal in that context. It’s business.
    - raincole 1y ago
      In other words, a smart business practice.
    - marginalia_nu 1y ago
      This isn't coming from nowhere though. China and Russia don't just randomly happen to have been assigned more bad actors online. Due to frosty diplomatic relations, there is a deliberate policy to do fuck all to enforce complaints when they come from the west, and at least with Russia, this is used as a means of gray zone cyberwarfare. China and Russia are being antisocial neighbors. Just like in real life, this does have ramifications for how you are treated.
- mort96 1y ago
  The percentage of US trips abroad which are to China must be minuscule, and I bet nobody in the US regularly uses a VPN to get a Chinese IP address. So blocking Chinese IP addresses is probably going to have a small impact on US customers. Blocking all abroad IP addresses, on the other hand, would impact people who just travel abroad or use VPNs. Not sure what your point is or why you're comparing these two things.
- thrown-0825 1y ago
  If you are traveling without a vpn then you are asking for trouble
  - lxgr 1y ago
    Yes, and I’m arguing that that’s due to companies engaging in silly pseudo-security. I wish that would stop.
    - ordu 1y ago
      It is not silly pseudo-security, it is economics. Ban Chinese, lower your costs while not losing any revenue. It is capitalism working as intended.
      - lxgr 1y ago
        Not sure I'd call dumping externalities on a minority of your customer base without recourse "capitalism working as intended". Capitalism is a means to an end, and allowable business practices are a two-way street between corporations and consumers, mediated by regulatory bodies and consumer protection agencies, at least in most functioning democracies.
        ordu 1y ago
        Maybe, but it doesn't change the fact, that no one is going to forbid me to ban IPs. Therefore I will ban IPs and IPs ranges because it is the cheapest solution.
        lxgr 1y ago
        Sure, you can keep blocking IPs, and I'll keep arguing for a ban on IP country bans (at least for existing customers) :)
        ordu 1y ago
        If you don't see that your campaign is futile and want to waste you time, just go ahead, don't ask for my permission.
- mvdtnz 1y ago
  You think all streaming services have banned non US IPs? What world do you live in?
  - lxgr 1y ago
    This is based on personal experience. At least two did not let me unsubscribe from abroad in the past.
    - throwawayffffas 1y ago
      Not letting you unsubscribe and blocking your IP are very different things. There are some that do not provide services in most countries but Netflix, Disney, paramount are pretty much global operations. HBO and peacock might not be available in Europe but I am guessing they are in Canada.
      - misiek08 1y ago
        In Europe we have all of them, with only few movies unavailable or additionally paid occasionally. Netflix, Disney, HBO, Prime and others work fine. Funny to see how narrow perspective some people have…
        deleted 1y ago
        [deleted]
        lxgr 1y ago
        Obligatory side note of "Europe is not a country". In several European countries, there is no HBO since Sky has some kind of exclusive contract for their content there, and that's where I was accordingly unable to unsubscribe from an US HBO plan.
      - rtpg 1y ago
        I think a lot of services end up sending you to a sort of generic "not in your country yet!" landing page in an awkward way that can make it hard to "just" get to your account page to do this kind of stuff. Netflix doesn't have this issue but I've seen services that seem to make it tough. Though sometimes that's just a phone call away. Though OTOH whining about this and knowing about VPNs and then complaining about the theoretical non-VPN-knower-but-having-subscriptions-to-cancel-and-is-allergic-to-phone-calls-or-calling-their-bank persona... like sure they exist but are we talking about any significant number of people here?
- gr8n3ss 1y ago
  [dead]
- sylware 1y ago
  Won't help: I get scans and script kiddy hack attempts from digital ocean, microsoft cloud (azure, stretchoid.com), google cloud, aws, and lately "hostpapa" via its 'IP colocation service'. Ofc it is instant fail-to-ban (it is not that hard to perform a basic email delivery to an existing account...). Traffic should be "privatize" as much as possible between IPv6 addresses (because you still have 'scanners' doing the whole internet all the time... "the nice guys scanning the whole internet for your protection... never to sell any scan data ofc). Public IP services are done for: going to be hell whatever you do. The right answer seems significantly big 'security and availability teams' with open and super simple internet standards. Yep the javascript internet has to go away and the app private protocols have too. No more whatng cartel web engine, or the worst: closed network protocols for "apps". And the most important: hardcore protocol simplicity, but doing a good enough job. It is common sense, but the planned obsolescence and kludgy bloat lovers won't let you...
- motorest 1y ago
  > Why stop there? Just block all non-US IPs! This is a perfectly good solution to many problems, if you are absolutely certain there is no conceivable way your service will be used from some regions. > Surely bad actors wouldn’t use VPNs or botnets, and your customers never travel abroad? Not a problem. Bad actors which are motivated enough to use VPNd or botnets are a different class of attacks that have different types of solutions. If you eliminate 95% of your problems with a single IP filter them you have no good argument to make against it.
  - calgoo 1y ago
    This. If someone wants to target you, they will target you. What this does is remove the noise and 90%+ of crap. Basically the same thing as changing the ssh port on a public facing server, reduce the automated crap attacks.
  - paulcole 1y ago
    > if you are absolutely certain there is no conceivable way your service will be used from some regions. This isn’t the bar you need to clear. It’s “if you’re comfortable with people in some regions not being able to use your service.”
- runroader 1y ago
  Oddly, my bank has no problem with non-US IPs, but my City's municipal payments site doesn't. I always think it's broken for a moment before realizing I have my VPN turned on.
- Avamander 1y ago
  > Surely bad actors wouldn’t use VPNs or botnets, and your customers never travel abroad? They usually don't bother. Plus it's easier to take action against malicious traffic within your own country or general jurisdiction.
sugarpimpdorsey 1y ago
There's some weird ones you'd never think of that originate an inordinate amount of bad traffic. Like Seychelles. A tiny little island nation in the middle of the ocean inhabited by... bots apparently? Cyprus is another one. Re: China, their cloud services seem to stretch to Singapore and beyond. I had to blacklist all of Alibaba Cloud and Tencent and the ASNs stretched well beyond PRC borders.
- seanhunter 1y ago
  The Seychelles has a sweetheart tax deal with India such that a lot of corporations who have an India part and a non-India part will set up a Seychelles corp to funnel cash between the two entities. Through the magic of "Transfer Pricing"[1] they use this to reduce the amount of tax they need to pay. It wouldn't surprise me if this is related somehow. Like maybe these are Indian corporations using a Seychelles offshore entity to do their scanning because then they can offset the costs against their tax or something. It may be that Cyprus has similar reasons. Istr that Cyprus was revealed to be important in providing a storefront to Russia and Putin-related companies and oligarchs.[2] So Seychelles may be India-related bots and Cyprus Russia-related bots. [1] https://taxjustice.net/faq/what-is-transfer-pricing/#:~:text=Transfer%20pricing%20is%20a%20technique,at%20an%20artificially%20high%20price. https://taxjustice.net/faq/what-is-transfer-pricing/#:~:text... [2] Yup. My memory originated in the "Panama Papers" leaks https://www.icij.org/investigations/cyprus-confidential/cyprus-model-politics-tax-haven-russian-wealth/ https://www.icij.org/investigations/cyprus-confidential/cypr...
- grandinj 1y ago
  There is a Chinese player that has taken effective control of various internet-related entities in the Seychelles. Various ongoing court-cases currently. So the seychelles traffic is likely really disguised chinese traffic.
  - supriyo-biswas 1y ago
    I don't think these are "Chinese players" and is linked to [1], although it may be that the hands changed many times that the IP addresses have been leased or bought by Chinese entities. [1] https://mybroadband.co.za/news/internet/350973-man-connected-to-african-ip-address-heist-running-for-board-position-at-european-ip-address-organisation.html https://mybroadband.co.za/news/internet/350973-man-connected...
thrown-0825 1y ago
Block Russia too, thats where i see most of my bot traffic coming from
- debesyla 1y ago
  And usually hackers/malicious actors from that country are not afraid to attack anyone that is not russian, because their local law permits attacking targets in other countries. (It sometimes comes to funny situations where malware doesn't enable itself on Windows machines if it detects that russian language keyboard is installed.)
imiric 1y ago
Lately I've been thinking that the only viable long-term solution are allowlists instead of blocklists. The internet has become a hostile place for any public server, and with the advent of ML tools, bots will make up far more than the current ~50% of all traffic. Captchas and bot detection is a losing strategy as bot behavior becomes more human-like. Governments will inevitably enact privacy-infringing regulation to deal with this problem, but for sites that don't want to adopt such nonsense, allowlists are the only viable option. I've been experimenting with a system where allowed users can create short-lived tokens via some out-of-band mechanism, which they can use on specific sites. A frontend gatekeeper then verifies the token, and if valid, opens up the required public ports specifically for the client's IP address, and redirects it to the service. The beauty of this system is that the service itself remains blocked at the network level from the world, and only allowed IP addresses are given access. The only publicly open port is the gatekeeper, which only accepts valid tokens, and can run from a separate machine or network. It also doesn't involve complex VPN or tunneling solutions, just a standard firewall. This should work well for small personal sites, where initial connection latency isn't a concern, but obviously wouldn't scale well at larger scales without some rethinking. For my use case, it's good enough.
- seer 1y ago
  I guess this is what "Identity aware proxy" from GCP can do for you? Outsource all of this to google - where you can connect your own identity servers, and then your service will only be accessed after the identity has been verified. We have been using that instead of VPN and it has been incredibly nice and performant.
  - imiric 1y ago
    Yeah, I suppose it's something like that. Except that my solution wouldn't rely on Google, would be open source and self-hostable. Are you aware of a similar project that does this? Would save me some time and effort. :) There also might be similar solutions for other cloud providers or some Kubernetes-adjacent abomination, but I specifically want something generic and standalone.
snickerbockers 1y ago
Lmao I came here to post this. My personal server was making constant hdd grinding noises before I banned the entire nation of China. I only use this server for jellyfin and datahoarding so this was all just logs constantly rolling over from failed ssh auth attempts (PSA: always use public-key, don't allow root, and don't use really obvious usernames like "webadmin" or <literally just the domain>).
- Xiol32 1y ago
  Changing the SSH port also helps cut down the noise, as part of a layered strategy.
  - dotancohen 1y ago
    Are you familiar with port knocking? My servers will only open port 22, or some other port, after two specific ports have been knocked on in order. It completely eliminates the log files getting clogged.
    - davsti4 1y ago
      I've used that solution in the past. What happens when the bots start port knocking?
      - GuinansEyebrows 1y ago
        Fail2ban :)
      - dotancohen 1y ago
        The bots have been port scanning me for decades. They just don't know which two ports to hit to open 22 for their IP address. Simply iterating won't get then there, and fail2ban doesn't afford them much opportunity to probe.
  - azthecx 1y ago
    Did you really notice a significant drop off in connection attempts? I tried this some years ago and after a few hours on a random very high port number I was already seeing connections.
adzicg 1y ago
We solved a similar issue by blocking free user traffic from data centres (and whitelisted crawlers for SEO). This eliminated most fraudulent usage over VPNs. Commercial users can still access, but free just users get a prompt to pay. CloudFront is fairly good at marking if someone is accessing from a data centre or a residential/commercial endpoint. It's not 100% accurate and really bad actors can still use infected residential machines to proxy traffic, but this fix was simple and reduced the problem to a negligent level.

lxgr 1y ago

Why stop there? Just block all non-US IPs! If it works for my health insurance company, essentially all streaming services (including not even being able to cancel service from abroad), and many banks, it’ll work for you as well. Surely bad actors wouldn’t use VPNs or botnets, and your customers never travel abroad?

lwansbrough 1y ago
Don't care, works fine for us.
- yupyupyups 1y ago
  And that's perfectly fine. Nothing is completely bulletproof anyway. If you manage to get rid of 90% of the problem then that's a good thing.
  - lxgr 1y ago
    And if your competitor manages to do so without annoying the part of their customer base that occasionally leaves the country, everybody wins!
    - yupyupyups 1y ago
      Fair point, that's something to consider.
  - ruszki 1y ago
    Okay, but this causes me about 90% of my major annoyances. Seriously. It’s almost always these stupid country restrictions. I was in UK. I wanted to buy a movie ticket there. Fuck me, because I have an Austrian ip address, because modern mobile backends pass your traffic through your home mobile operator. So I tried to use a VPN. Fuck me, VPN endpoints are blocked also. I wanted to buy a Belgian train ticket still from home. Cloudflare fuck me, because I’m too suspicious as a foreigner. It broke their whole API access, which was used by their site. I wanted to order something while I was in America at my friend’s place. Fuck me of course. Not just my IP was problematic, but my phone number too. And of course my bank card… and I just wanted to order a pizza. The most annoying is when your fucking app is restricted to your stupid country, and I should use it because your app is a public transport app. Lovely. And of course, there was that time when I moved to an other country… pointless country restrictions everywhere… they really helped. I remember the times when the saying was that the checkout process should be as frictionless as possible. That sentiment is long gone.
    - lwansbrought 1y ago
      [dead]
    - BoredPositron 1y ago
      The vpn is probably your problem there mate.
      - ruszki 1y ago
        I don’t use VPN generally, only in specific cases. For example, when I want to reach Australian news. Because of course, as a non Australian, I couldn’t care about local news. Or when American pages rather ban Europe than they would tell who they sell my data to.
      - Dylan16807 1y ago
        They tried a VPN as a backup for one of those problems. So no. It's not.
    - sarchertech 1y ago
- Nemi 1y ago
  Worked great for us, but I had to turn it off. Why? Because the IP databases that the two services I was using are not accurate enough and some people in the US were being blocked as if they had a foreign IP address. It happened regularly enough I reluctantly had to turn it off and now I have to deal the non-stop hacking attempts on the website. For the record, my website is a front end for a local-only business. Absolutely no reason for anyone outside the US to participate.
raffraffraff 1y ago
And across the water, my wife has banned US IP addresses from her online shop once or twice. She runs a small business making products that don't travel well, and would cost a lot to ship to the US. It's a huge country with many people. Answering pointless queries, saying "No, I can't do that" in 50 different ways and eventually dealing with negative reviews from people you've never sold to and possibly even never talked to... Much easier to mass block. I call it network segmentation. She's also blocked all of Asia, Africa, Australia and half of Europe. The blocks don't stay in place forever, just a few months.
- silisili 1y ago
  Google Shopping might be to blame here, and I don't at all blame the response. I say that because I can't count how many times Google has taken me to a foreign site that either doesn't even ship to the US, or doesn't say one way or another and treat me like a crazy person for asking.
- lxgr 1y ago
  As long as your customer base never travels and needs support, sure, I guess. The only way of communicating with such companies are chargebacks through my bank (which always at least has a phone number reachable from abroad), so I’d make sure to account for these.
  - closewith 1y ago
    Chargebacks aren't the panacea you're used to outside the US, so that's a non-issue.
    - lxgr 1y ago
      Only if your bank isn't competent in using them. Visa/Mastercard chargeback rules largely apply worldwide (with some regional exceptions, but much less than many banks would make you believe).
      - closewith 1y ago
silisili 1y ago
I'm not precisely sure the point you're trying to make. In my experience running rather lowish traffic(thousands hits a day) sites, doing just that brought every single annoyance from thousands per day to zero. Yes, people -can- easily get around it via various listed methods, but don't seem to actually do that unless you're a high value target.
- lxgr 1y ago
  It definitely works, since you’re externalizing your annoyance to people you literally won’t ever hear from because you blanket banned them based. Most of them will just think your site is broken.
  - aspenmayer 1y ago
    It seems to be a choice they’re making with their eyes open. If folks running a storefront don’t want to associate with you, it’s not personal in that context. It’s business.
  - raincole 1y ago
    In other words, a smart business practice.
  - marginalia_nu 1y ago
    This isn't coming from nowhere though. China and Russia don't just randomly happen to have been assigned more bad actors online. Due to frosty diplomatic relations, there is a deliberate policy to do fuck all to enforce complaints when they come from the west, and at least with Russia, this is used as a means of gray zone cyberwarfare. China and Russia are being antisocial neighbors. Just like in real life, this does have ramifications for how you are treated.
mort96 1y ago
The percentage of US trips abroad which are to China must be minuscule, and I bet nobody in the US regularly uses a VPN to get a Chinese IP address. So blocking Chinese IP addresses is probably going to have a small impact on US customers. Blocking all abroad IP addresses, on the other hand, would impact people who just travel abroad or use VPNs. Not sure what your point is or why you're comparing these two things.
thrown-0825 1y ago
If you are traveling without a vpn then you are asking for trouble
- lxgr 1y ago
  Yes, and I’m arguing that that’s due to companies engaging in silly pseudo-security. I wish that would stop.
  - ordu 1y ago
    It is not silly pseudo-security, it is economics. Ban Chinese, lower your costs while not losing any revenue. It is capitalism working as intended.
    - lxgr 1y ago
      Not sure I'd call dumping externalities on a minority of your customer base without recourse "capitalism working as intended". Capitalism is a means to an end, and allowable business practices are a two-way street between corporations and consumers, mediated by regulatory bodies and consumer protection agencies, at least in most functioning democracies.
      - ordu 1y ago
        Maybe, but it doesn't change the fact, that no one is going to forbid me to ban IPs. Therefore I will ban IPs and IPs ranges because it is the cheapest solution.
        lxgr 1y ago
        Sure, you can keep blocking IPs, and I'll keep arguing for a ban on IP country bans (at least for existing customers) :)
        ordu 1y ago
        If you don't see that your campaign is futile and want to waste you time, just go ahead, don't ask for my permission.
mvdtnz 1y ago
You think all streaming services have banned non US IPs? What world do you live in?
- lxgr 1y ago
  This is based on personal experience. At least two did not let me unsubscribe from abroad in the past.
  - throwawayffffas 1y ago
    Not letting you unsubscribe and blocking your IP are very different things. There are some that do not provide services in most countries but Netflix, Disney, paramount are pretty much global operations. HBO and peacock might not be available in Europe but I am guessing they are in Canada.
    - misiek08 1y ago
      In Europe we have all of them, with only few movies unavailable or additionally paid occasionally. Netflix, Disney, HBO, Prime and others work fine. Funny to see how narrow perspective some people have…
      - deleted 1y ago
        [deleted]
      - lxgr 1y ago
        Obligatory side note of "Europe is not a country". In several European countries, there is no HBO since Sky has some kind of exclusive contract for their content there, and that's where I was accordingly unable to unsubscribe from an US HBO plan.
    - rtpg 1y ago
      I think a lot of services end up sending you to a sort of generic "not in your country yet!" landing page in an awkward way that can make it hard to "just" get to your account page to do this kind of stuff. Netflix doesn't have this issue but I've seen services that seem to make it tough. Though sometimes that's just a phone call away. Though OTOH whining about this and knowing about VPNs and then complaining about the theoretical non-VPN-knower-but-having-subscriptions-to-cancel-and-is-allergic-to-phone-calls-or-calling-their-bank persona... like sure they exist but are we talking about any significant number of people here?
gr8n3ss 1y ago
[dead]
sylware 1y ago
Won't help: I get scans and script kiddy hack attempts from digital ocean, microsoft cloud (azure, stretchoid.com), google cloud, aws, and lately "hostpapa" via its 'IP colocation service'. Ofc it is instant fail-to-ban (it is not that hard to perform a basic email delivery to an existing account...). Traffic should be "privatize" as much as possible between IPv6 addresses (because you still have 'scanners' doing the whole internet all the time... "the nice guys scanning the whole internet for your protection... never to sell any scan data ofc). Public IP services are done for: going to be hell whatever you do. The right answer seems significantly big 'security and availability teams' with open and super simple internet standards. Yep the javascript internet has to go away and the app private protocols have too. No more whatng cartel web engine, or the worst: closed network protocols for "apps". And the most important: hardcore protocol simplicity, but doing a good enough job. It is common sense, but the planned obsolescence and kludgy bloat lovers won't let you...
motorest 1y ago
> Why stop there? Just block all non-US IPs! This is a perfectly good solution to many problems, if you are absolutely certain there is no conceivable way your service will be used from some regions. > Surely bad actors wouldn’t use VPNs or botnets, and your customers never travel abroad? Not a problem. Bad actors which are motivated enough to use VPNd or botnets are a different class of attacks that have different types of solutions. If you eliminate 95% of your problems with a single IP filter them you have no good argument to make against it.
- calgoo 1y ago
  This. If someone wants to target you, they will target you. What this does is remove the noise and 90%+ of crap. Basically the same thing as changing the ssh port on a public facing server, reduce the automated crap attacks.
- paulcole 1y ago
  > if you are absolutely certain there is no conceivable way your service will be used from some regions. This isn’t the bar you need to clear. It’s “if you’re comfortable with people in some regions not being able to use your service.”
runroader 1y ago
Oddly, my bank has no problem with non-US IPs, but my City's municipal payments site doesn't. I always think it's broken for a moment before realizing I have my VPN turned on.
Avamander 1y ago
> Surely bad actors wouldn’t use VPNs or botnets, and your customers never travel abroad? They usually don't bother. Plus it's easier to take action against malicious traffic within your own country or general jurisdiction.

sugarpimpdorsey 1y ago

There's some weird ones you'd never think of that originate an inordinate amount of bad traffic. Like Seychelles. A tiny little island nation in the middle of the ocean inhabited by... bots apparently? Cyprus is another one. Re: China, their cloud services seem to stretch to Singapore and beyond. I had to blacklist all of Alibaba Cloud and Tencent and the ASNs stretched well beyond PRC borders.

seanhunter 1y ago
The Seychelles has a sweetheart tax deal with India such that a lot of corporations who have an India part and a non-India part will set up a Seychelles corp to funnel cash between the two entities. Through the magic of "Transfer Pricing"[1] they use this to reduce the amount of tax they need to pay. It wouldn't surprise me if this is related somehow. Like maybe these are Indian corporations using a Seychelles offshore entity to do their scanning because then they can offset the costs against their tax or something. It may be that Cyprus has similar reasons. Istr that Cyprus was revealed to be important in providing a storefront to Russia and Putin-related companies and oligarchs.[2] So Seychelles may be India-related bots and Cyprus Russia-related bots. [1] https://taxjustice.net/faq/what-is-transfer-pricing/#:~:text=Transfer%20pricing%20is%20a%20technique,at%20an%20artificially%20high%20price. https://taxjustice.net/faq/what-is-transfer-pricing/#:~:text... [2] Yup. My memory originated in the "Panama Papers" leaks https://www.icij.org/investigations/cyprus-confidential/cyprus-model-politics-tax-haven-russian-wealth/ https://www.icij.org/investigations/cyprus-confidential/cypr...
grandinj 1y ago
There is a Chinese player that has taken effective control of various internet-related entities in the Seychelles. Various ongoing court-cases currently. So the seychelles traffic is likely really disguised chinese traffic.
- supriyo-biswas 1y ago
  I don't think these are "Chinese players" and is linked to [1], although it may be that the hands changed many times that the IP addresses have been leased or bought by Chinese entities. [1] https://mybroadband.co.za/news/internet/350973-man-connected-to-african-ip-address-heist-running-for-board-position-at-european-ip-address-organisation.html https://mybroadband.co.za/news/internet/350973-man-connected...

thrown-0825 1y ago

Block Russia too, thats where i see most of my bot traffic coming from

debesyla 1y ago
And usually hackers/malicious actors from that country are not afraid to attack anyone that is not russian, because their local law permits attacking targets in other countries. (It sometimes comes to funny situations where malware doesn't enable itself on Windows machines if it detects that russian language keyboard is installed.)

imiric 1y ago

Lately I've been thinking that the only viable long-term solution are allowlists instead of blocklists. The internet has become a hostile place for any public server, and with the advent of ML tools, bots will make up far more than the current ~50% of all traffic. Captchas and bot detection is a losing strategy as bot behavior becomes more human-like. Governments will inevitably enact privacy-infringing regulation to deal with this problem, but for sites that don't want to adopt such nonsense, allowlists are the only viable option. I've been experimenting with a system where allowed users can create short-lived tokens via some out-of-band mechanism, which they can use on specific sites. A frontend gatekeeper then verifies the token, and if valid, opens up the required public ports specifically for the client's IP address, and redirects it to the service. The beauty of this system is that the service itself remains blocked at the network level from the world, and only allowed IP addresses are given access. The only publicly open port is the gatekeeper, which only accepts valid tokens, and can run from a separate machine or network. It also doesn't involve complex VPN or tunneling solutions, just a standard firewall. This should work well for small personal sites, where initial connection latency isn't a concern, but obviously wouldn't scale well at larger scales without some rethinking. For my use case, it's good enough.

seer 1y ago
I guess this is what "Identity aware proxy" from GCP can do for you? Outsource all of this to google - where you can connect your own identity servers, and then your service will only be accessed after the identity has been verified. We have been using that instead of VPN and it has been incredibly nice and performant.
- imiric 1y ago
  Yeah, I suppose it's something like that. Except that my solution wouldn't rely on Google, would be open source and self-hostable. Are you aware of a similar project that does this? Would save me some time and effort. :) There also might be similar solutions for other cloud providers or some Kubernetes-adjacent abomination, but I specifically want something generic and standalone.

snickerbockers 1y ago

Lmao I came here to post this. My personal server was making constant hdd grinding noises before I banned the entire nation of China. I only use this server for jellyfin and datahoarding so this was all just logs constantly rolling over from failed ssh auth attempts (PSA: always use public-key, don't allow root, and don't use really obvious usernames like "webadmin" or <literally just the domain>).

Xiol32 1y ago
Changing the SSH port also helps cut down the noise, as part of a layered strategy.
- dotancohen 1y ago
  Are you familiar with port knocking? My servers will only open port 22, or some other port, after two specific ports have been knocked on in order. It completely eliminates the log files getting clogged.
  - davsti4 1y ago
    I've used that solution in the past. What happens when the bots start port knocking?
    - GuinansEyebrows 1y ago
      Fail2ban :)
    - dotancohen 1y ago
      The bots have been port scanning me for decades. They just don't know which two ports to hit to open 22 for their IP address. Simply iterating won't get then there, and fail2ban doesn't afford them much opportunity to probe.
- azthecx 1y ago
  Did you really notice a significant drop off in connection attempts? I tried this some years ago and after a few hours on a random very high port number I was already seeing connections.

adzicg 1y ago

We solved a similar issue by blocking free user traffic from data centres (and whitelisted crawlers for SEO). This eliminated most fraudulent usage over VPNs. Commercial users can still access, but free just users get a prompt to pay. CloudFront is fairly good at marking if someone is accessing from a data centre or a residential/commercial endpoint. It's not 100% accurate and really bad actors can still use infected residential machines to proxy traffic, but this fix was simple and reduced the problem to a negligent level.