4 ms·

There's some weird ones you'd never think of that originate an inordinate amount of bad traffic. Like Seychelles. A tiny little island nation in the middle of t

There's some weird ones you'd never think of that originate an inordinate amount of bad traffic. Like Seychelles. A tiny little island nation in the middle of the ocean inhabited by... bots apparently? Cyprus is another one. Re: China, their cloud services seem to stretch to Singapore and beyond. I had to blacklist all of Alibaba Cloud and Tencent and the ASNs stretched well beyond PRC borders.

seanhunter 1y ago
The Seychelles has a sweetheart tax deal with India such that a lot of corporations who have an India part and a non-India part will set up a Seychelles corp to funnel cash between the two entities. Through the magic of "Transfer Pricing"[1] they use this to reduce the amount of tax they need to pay. It wouldn't surprise me if this is related somehow. Like maybe these are Indian corporations using a Seychelles offshore entity to do their scanning because then they can offset the costs against their tax or something. It may be that Cyprus has similar reasons. Istr that Cyprus was revealed to be important in providing a storefront to Russia and Putin-related companies and oligarchs.[2] So Seychelles may be India-related bots and Cyprus Russia-related bots. [1] https://taxjustice.net/faq/what-is-transfer-pricing/#:~:text=Transfer%20pricing%20is%20a%20technique,at%20an%20artificially%20high%20price. https://taxjustice.net/faq/what-is-transfer-pricing/#:~:text... [2] Yup. My memory originated in the "Panama Papers" leaks https://www.icij.org/investigations/cyprus-confidential/cyprus-model-politics-tax-haven-russian-wealth/ https://www.icij.org/investigations/cyprus-confidential/cypr...
grandinj 1y ago
There is a Chinese player that has taken effective control of various internet-related entities in the Seychelles. Various ongoing court-cases currently. So the seychelles traffic is likely really disguised chinese traffic.
- supriyo-biswas 1y ago
  I don't think these are "Chinese players" and is linked to [1], although it may be that the hands changed many times that the IP addresses have been leased or bought by Chinese entities. [1] https://mybroadband.co.za/news/internet/350973-man-connected-to-african-ip-address-heist-running-for-board-position-at-european-ip-address-organisation.html https://mybroadband.co.za/news/internet/350973-man-connected...
- galaxy_gas 1y ago
  this all from Cloud Innovation vpns,proxies,spam,bots CN Seychelles IP holder
- sylware 1y ago
  omg... that's why my self-hosted servers are getting nasty trafic from SC all the time. The explanation is that easy??
- lwansbrought 1y ago
  > So the seychelles traffic is likely really disguised chinese traffic. Soon: chineseplayer.io
- sylware 1y ago
  I forgot about that: all the nice game binaries from them running directly on nearly all systems...
  - lukan 1y ago
    Huh? Who is them in this case?
    - ronsor 1y ago
      They're referring to the fact that Chinese game companies (Tencent, Riot through Tencent, etc.) all have executables of varying levels of suspicion (i.e. anti-cheat modules) running in the background on player computers. Then they're making the claim that those binaries have botnet functionality.
      - sylware 1y ago
        They can exploit local priviledge escalation flaws without "RCE". And you are right, kernel anti-cheat are rumored to be weaponized by hackers, and making the previous even worse. And when the kid is playing his/her game at home, if daddy or mummy is a person of interest, they are already on the home LAN... Well, you get the picture: nowhere to run, orders of magnitude worse than it was before. Nowadays, the only level of protection the administrator/root access rights give you, is to mitigate any user mistake which would break his/her system... sad...
- conradev 1y ago
  Interesting: https://techafricanews.com/2025/07/24/smart-africa-calls-for-coordinated-continental-action-to-protect-africas-digital-sovereignty/ https://techafricanews.com/2025/07/24/smart-africa-calls-for...
sim7c00 1y ago
its not weird .its companies putting themselves in places where regulations favor their business models. it wont be all chinese companies or ppl doing the scraping. its well known that a lot of countries dont mind such traffic as long as it doesnt target themselves or for the west also some allies. laws arent the same everywhere and so companies can get away with behavior in one place which seem almost criminal in another. and what better place to put your scrapers than somewhere where there is no copyright. russia also had same but since 2012 or so they changed laws and a lot of traffic reduced. companies moved to small islands or small nation states (favoring them with their tax payouts, they dont mind if j bring money for them) or few remaining places like china who dont care for copyrights. its pretty hard to get really rid of such traffic. you can block stuff but mostly it will just change the response your server gives. flood still knockin at the door. id hope someday maybe ISPs or so get more creative but maybe they dont have enough access and its hard to do this stuff without the right access into the traffic (creepy kind) or running into accidentally censoring the whole thing.
johnisgood 1y ago
[flagged]
- sylware 1y ago
  ucloud ("based in HK") has been an issue (much less lately though), and I had to ban the whole digital ocean AS (US). google cloud, aws and microsoft have also some issues... hostpapa in the US seems to become the new main issue (via what seems a 'ip colocation service'... yes, you read well).
- pabs3 1y ago
  Which site is it?
  - johnisgood 1y ago
    My own shitty personal website that is so uninteresting that I do not even wish to disclose here. Hence my lack of understanding of the down-votes for me doing what works for my OWN shitty website, well, server. In fact, I bet it would choke on a small amount of traffic from here considering it has a shitty vCPU with 512 MB RAM.
    - spacecadet 1y ago
      [flagged]
      - johnisgood 1y ago
        Thanks, appreciate it. I would hope so. I do not care about down-votes per se, my main complaint is really the fact that I am somehow in the wrong for doing what I deem is right for my shitty server(s).
    - pabs3 1y ago
      Personal sites are definitely interesting, way more interesting than most of the rest of the web. I was thinking I would put your site into archive.org, using ArchiveBot, with reasonable crawl delay, so that it is preserved if your hardware dies. Ask on the ArchiveTeam IRC if you want that to happen. https://chat.hackint.org/?join=%23archiveteam-bs https://chat.hackint.org/?join=%23archiveteam-bs
ectospheno 1y ago
If you IP block all of China then run a resolver the logs will quickly fill with innocuous domains with NS entries that are blocked. Add those to a dns block list then add their ASN to your company IP block list. Amazing how traffic you don’t want plummets.

seanhunter 1y ago

The Seychelles has a sweetheart tax deal with India such that a lot of corporations who have an India part and a non-India part will set up a Seychelles corp to funnel cash between the two entities. Through the magic of "Transfer Pricing"[1] they use this to reduce the amount of tax they need to pay. It wouldn't surprise me if this is related somehow. Like maybe these are Indian corporations using a Seychelles offshore entity to do their scanning because then they can offset the costs against their tax or something. It may be that Cyprus has similar reasons. Istr that Cyprus was revealed to be important in providing a storefront to Russia and Putin-related companies and oligarchs.[2] So Seychelles may be India-related bots and Cyprus Russia-related bots. [1] https://taxjustice.net/faq/what-is-transfer-pricing/#:~:text=Transfer%20pricing%20is%20a%20technique,at%20an%20artificially%20high%20price. https://taxjustice.net/faq/what-is-transfer-pricing/#:~:text... [2] Yup. My memory originated in the "Panama Papers" leaks https://www.icij.org/investigations/cyprus-confidential/cyprus-model-politics-tax-haven-russian-wealth/ https://www.icij.org/investigations/cyprus-confidential/cypr...

grandinj 1y ago

There is a Chinese player that has taken effective control of various internet-related entities in the Seychelles. Various ongoing court-cases currently. So the seychelles traffic is likely really disguised chinese traffic.

supriyo-biswas 1y ago
I don't think these are "Chinese players" and is linked to [1], although it may be that the hands changed many times that the IP addresses have been leased or bought by Chinese entities. [1] https://mybroadband.co.za/news/internet/350973-man-connected-to-african-ip-address-heist-running-for-board-position-at-european-ip-address-organisation.html https://mybroadband.co.za/news/internet/350973-man-connected...
galaxy_gas 1y ago
this all from Cloud Innovation vpns,proxies,spam,bots CN Seychelles IP holder
sylware 1y ago
omg... that's why my self-hosted servers are getting nasty trafic from SC all the time. The explanation is that easy??
lwansbrought 1y ago
> So the seychelles traffic is likely really disguised chinese traffic. Soon: chineseplayer.io
sylware 1y ago
I forgot about that: all the nice game binaries from them running directly on nearly all systems...
- lukan 1y ago
  Huh? Who is them in this case?
  - ronsor 1y ago
    They're referring to the fact that Chinese game companies (Tencent, Riot through Tencent, etc.) all have executables of varying levels of suspicion (i.e. anti-cheat modules) running in the background on player computers. Then they're making the claim that those binaries have botnet functionality.
    - sylware 1y ago
      They can exploit local priviledge escalation flaws without "RCE". And you are right, kernel anti-cheat are rumored to be weaponized by hackers, and making the previous even worse. And when the kid is playing his/her game at home, if daddy or mummy is a person of interest, they are already on the home LAN... Well, you get the picture: nowhere to run, orders of magnitude worse than it was before. Nowadays, the only level of protection the administrator/root access rights give you, is to mitigate any user mistake which would break his/her system... sad...
conradev 1y ago
Interesting: https://techafricanews.com/2025/07/24/smart-africa-calls-for-coordinated-continental-action-to-protect-africas-digital-sovereignty/ https://techafricanews.com/2025/07/24/smart-africa-calls-for...

sim7c00 1y ago

its not weird .its companies putting themselves in places where regulations favor their business models. it wont be all chinese companies or ppl doing the scraping. its well known that a lot of countries dont mind such traffic as long as it doesnt target themselves or for the west also some allies. laws arent the same everywhere and so companies can get away with behavior in one place which seem almost criminal in another. and what better place to put your scrapers than somewhere where there is no copyright. russia also had same but since 2012 or so they changed laws and a lot of traffic reduced. companies moved to small islands or small nation states (favoring them with their tax payouts, they dont mind if j bring money for them) or few remaining places like china who dont care for copyrights. its pretty hard to get really rid of such traffic. you can block stuff but mostly it will just change the response your server gives. flood still knockin at the door. id hope someday maybe ISPs or so get more creative but maybe they dont have enough access and its hard to do this stuff without the right access into the traffic (creepy kind) or running into accidentally censoring the whole thing.

johnisgood 1y ago

[flagged]

sylware 1y ago
ucloud ("based in HK") has been an issue (much less lately though), and I had to ban the whole digital ocean AS (US). google cloud, aws and microsoft have also some issues... hostpapa in the US seems to become the new main issue (via what seems a 'ip colocation service'... yes, you read well).
pabs3 1y ago
Which site is it?
- johnisgood 1y ago
  My own shitty personal website that is so uninteresting that I do not even wish to disclose here. Hence my lack of understanding of the down-votes for me doing what works for my OWN shitty website, well, server. In fact, I bet it would choke on a small amount of traffic from here considering it has a shitty vCPU with 512 MB RAM.
  - spacecadet 1y ago
    [flagged]
    - johnisgood 1y ago
      Thanks, appreciate it. I would hope so. I do not care about down-votes per se, my main complaint is really the fact that I am somehow in the wrong for doing what I deem is right for my shitty server(s).
  - pabs3 1y ago
    Personal sites are definitely interesting, way more interesting than most of the rest of the web. I was thinking I would put your site into archive.org, using ArchiveBot, with reasonable crawl delay, so that it is preserved if your hardware dies. Ask on the ArchiveTeam IRC if you want that to happen. https://chat.hackint.org/?join=%23archiveteam-bs https://chat.hackint.org/?join=%23archiveteam-bs

ectospheno 1y ago

If you IP block all of China then run a resolver the logs will quickly fill with innocuous domains with NS entries that are blocked. Add those to a dns block list then add their ASN to your company IP block list. Amazing how traffic you don’t want plummets.