Post #2409445

2025-04-23 12:29 UTC

@rene_mobile@infosec.exchange i'm curious: do they at least have a proper user agent, or just chrome as it's probably a puppeteer/selenium thing? My suggestion: You embed a script that gets blocked by easylist - and anyone who hits it gets blocklisted for 10 minutes + forwarded to google via js. I'd asume even jsblocking crawlers would still try to open the js - unlick jsblockers or adblockers.

Replies (1)

@rene_mobile@infosec.exchange 2025-04-23 15:11

@rnbwdsh@chaos.social User agent strings seem to be intentionally misleading. Some examples I see: "Mozilla/5.0 (X11; U; Linux armv7l; en-GB; rv:1.9.2.3pre) Gecko/20100723 Firefox/3.6.11", "Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.99 Safari/533.4", "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/418 (KHTML, like Gecko) Safari/417.9.2", Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.134 Safari/534.16", "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b6pre) Gecko/20100903 Firefox/4.0b6pre", etc. That's part of why I am calling them out as illegal, malicious DDoS.

Open ##2409446