The internet is no longer a safe haven

I wonder if you can have a chain of "invisible" links on your site that a normal person wouldn't see or click. The links can go page A -> page B -> page C, where a request for C = instant IP ban.

IP addresses from scrapers are innumerable and in constant rotation.

Scrapers nowadays can use residential and mobile IPs, so banning by IP, even if actual malicious requests are coming from them, can also prevent actual unrelated people from accessing your service.

I self host and I have something like this but more obvious: i wrote a web service that talks to my mikrotik via API and add the IP of the requester to the block list with a 30 day timeout (configurable ofc). It hostname is "bot-ban-me.myexamplesite.com" and it is like a normal site in my reverse proxy. So when I request a cert this hostname is in the cert, and in the first few minutes i can catch lots of bad apples. I do not expect anyone to ever type this. I do not mention the address or anything anywhere, so the only way to land there is to watch the CT logs.

There was an article just yesterday which detailed doing this as not in order to ban but in order to waste time. You can also zip bomb people which is entertaining but probably not super effective.

https://herman.bearblog.dev/messing-with-bots/

https://news.ycombinator.com/item?id=45935729

I do something like this. Every page gets an invisible link to a honeypot. Click the link, 48hr ban.

Honestly I have no idea how well it works, my logs are still full of bots. *Slow* bots, though. As long as they’re not ddosing me I guess it’s fine?

Unless you're running a very popular service, unlikely that a random residential IP would be both compromised by a malicious VPN and also trying to access your site legitimately.

We do something similar for ssh. If a remote connection tries to log in as "root" or "admin" or any number of other usernames that indicate a probe for vulnerable configurations, that's an insta-ban for that IP address (banned not only for SSH but for everything).

How can a scraper get a mobile IP address?

Just one of many offering this service https://brightdata.com/proxy-types/mobile-proxies

Lots of people have chrome extensions installed that use their connection like proxy so this is more common than you think

Can you provide any examples of these extensions? I'm not doubting you, just curious.

There's one mentioned here: https://www.bleepingcomputer.com/news/security/data-stealing...

Anyone who owns a chrome extension with 50k+ installs is regularly asked to sell it to people (myself included). The people who buy the extensions try to monetize them any way they can, like proxying traffic for malicious scrapers / attacks.

Botnets are massive these days.

Also a lot of big companies are paying for residential "proxies" to scrape traffic from for AI.

Bright VPN

https://en.wikipedia.org/wiki/Bright_Data