8 Jul
2026
8 Jul
'26
8:13 a.m.
On Wed, Jul 8, 2026 at 10:57 AM Cameron Kaiser via cctalk <
cctalk(a)classiccmp.org> wrote:
It's all about the frequency. Also, you want to catch all of this stuff
before a page load is attempted. This way when 1200 requests come in
within the span of 5 minutes you can harmlessly deflect them. It took a
while to perfect what works for my network, everyone is different.
Firewall is also important.
> i wrote a
program that counts requests by IP and frequency. That and
some
> fancy code to teduce server load and the bots
are blocked fairly well.
I
Something that fail2ban can't handle?
I'm not sure how well fail2ban would work for any of this. The majority of
machines hitting my hardware are residential IPs through proxy services.
It is
unusual for there to be more than a handful from any one address, which is
why
I've ended up querying ASNs for abusive traffic and dumping whole routes
into
the the packet filter.