Known Bots 6.1.0

[Alvin63]

We block the entire ASN block at the server level. (We don’t use CloudFlare) We get the raw IP data associated with their ASN ID and load that into our firewall.

So do you block it in htaccess as well as blocking its IP ranges in the server panel?

 

[Chromaniac]

blocking asn works very well with cloudflare. can be done using the digitalpoint addon from xenforo backend.

 

[ENF]

So do you block it in htaccess as well as blocking its IP ranges in the server panel?

If you're using CF, you can block the relative ASN ID.

#1: 396986 / https://asn.ipinfo.app/AS396986
#2: 138699 / https://asn.ipinfo.app/AS138699

This should neuter most of their access at your border (CF).

 

[Alvin63]

blocking asn works very well with cloudflare. can be done using the digitalpoint addon from xenforo backend.

Thank you. I already tried blocking it in the Cloudflare app via a firewall rule and it still appeared on the site. So I'm wondering if it bypasses Cloudflare. If that's the case, none of the Cloudflare settings will help.

 

[Chromaniac]

try getting a new ip from your host and stop ip leaks through unfurl/proxy etc which i think you already did using the digitalpoint addon.

 

[Alvin63]

try getting a new ip from your host and stop ip leaks through unfurl/proxy etc which i think you already did using the digitalpoint addon.

Yes I did use the proxy in the digitalpoint addon. However I am wondering if ByteDance obtained the server IP from the site before I used the addon - ie before that was proxied (it was certainly crawling the site before I used the addon). Can I actually get a new IP from the server if it's shared hosting?

 

[Chromaniac]

would depend upon how flexible the host is. in case of shared environment, they would need to move you to another server which is possible and i have done it on shared hosting before. talk to your host. tell them you are getting hammered on this ip address and you would like to switch to a different one.

 

[ENF]

Getting a new IP won't really solve the problem, if the source of the problem isn't not blocked at other levels. (excluding CF)
These guys just scan subnets looking for active sites - it's only a matter of time until they come back.

(And, since it's shared hosting, I'm willing to bet that there are other sites on the same IP address, which I'm sure are already exposed and anything you move to, will likely already have been out there for some time.)

 

[Alvin63]

I wondered that. There is an option to change to a cloud hosting service with a dedicated IP address which isn't a particularly expensive upgrade - but I expect that IP address has been used before somewhere as well.

So what other levels could I block it at, outside Cloudflare? htaccess?