Post #4097837
2026-07-25 19:22 UTC
@wrmsr@peering.social I find it frankly shocking that 100% of the abuse on my webcluster comes from AS8075 Azure. Sheesh.
However the implication is that sending them /dev/urandom is going to cost me a lot of bandwidth for ~zero gain. I think I may just ban AS8075 alltogether :)
Replies (2)
-
@jtk@infosec.exchange 2026-07-25 21:44
@IPngNetworks@ublog.tech @wrmsr@peering.social You could always announce your prefixes with AS8075 in the path, make them drop it for you >:)
-
@wrmsr@peering.social 2026-07-25 19:27
@IPngNetworks@ublog.tech GCP, Linode, DO, AWS... Changing their UA every request but JA4 staying the same I've throttled that backend to 500mbps total so that those bots won't eat up my bandwith Fun things with HAProxy and some custom Lua, might try to just do request tarpit-ing next and see how they behave