Ask HN: Can we collaborate on a IP Address or Regex blacklist?

Re:Ask HN: Can we collaborate on a IP Address or Regex black... by trinovantes on Tuesday April 06, 2021 @10:50PM (#26720063)

There was a GitHub repo posted sometime ago that contained a list of ASNs (basically ids of datacenters) where most attackers/spammers come from. Simply blocking those ASNs helped the author stop almost all of their bad requests. I wish I bookmarked it but maybe somebody else can chime in...

[ Parent | on HN ]

Re:Ask HN: Can we collaborate on a IP Address or Regex black... by dataflow on Tuesday April 06, 2021 @11:04PM (#26720145)

This? https://news.ycombinator.com/item?id=15506954

[ Parent | on HN ]

Re:Ask HN: Can we collaborate on a IP Address or Regex black... by usernamebias on Tuesday April 06, 2021 @11:09PM (#26720173)

Thats a great start. But blocking entire data centers seems too aggressive for public SaaS applications.

This has lit a fire in my arse. I'm going to create a repo tomorrow for ExpressJS (I'm a NodeJS nerd).

It can be used like this

app.use(blacklist.middleware)

It will compare every request to a known .txt of strings such as '.env' and others.

Regex is NOT my forte, Can I count on some of you guys to pitch in?

[ Parent | on HN ]

Re:Ask HN: Can we collaborate on a IP Address or Regex black... by jamal-kumar on Tuesday April 06, 2021 @11:22PM (#26720253)

Yeah you're looking at something external to your application like a layer 7 firewall, I don't think nodejs is the tool for the job here. You want to stop this traffic way before it even hits your web service with an external WAF.

[ Parent | on HN ]

Re:Ask HN: Can we collaborate on a IP Address or Regex black... by jamal-kumar on Tuesday April 06, 2021 @11:26PM (#26720273)

https://support.cloudflare.com/hc/en-us/articles/200172016-U...

no it's not lmao

[ Parent | on HN ]

Re:Ask HN: Can we collaborate on a IP Address or Regex black... by usernamebias on Tuesday April 06, 2021 @11:25PM (#26720269)

That's beyond my capabilities. I can certainly create a big preliminary .txt file from my dataset, and hopefully the open source community can take it from there.

[ Parent | on HN ]

Re:Ask HN: Can we collaborate on a IP Address or Regex black... by thephyber on Tuesday April 06, 2021 @11:36PM (#26720336)

CloudFlare is not beyond your capabilities.

If you have a domain name (as opposed to just an IP address), you could have finished this project with CloudFlare in the time it took you to post to HN. You are almost certainly going to fall into the free tier.

Disclaimer: I used to work for the founders of CloudFlare.

Note: CloudFlare is not the only SaaS / PaaS in this CDN/WAF space, but it is the easiest to get started with (last I checked).

[ Parent | on HN ]

Re:Ask HN: Can we collaborate on a IP Address or Regex black... by thephyber on Tuesday April 06, 2021 @11:28PM (#26720282)

Have you considered the scale of the problem and how it would affect performance on your server?

Running pattern matching early in Node middleware that checks against a very very large block list will progressively choke every server that implements it.

If you decide to implement it, I recommend you look at how GeoMind API works. IP addresses are just displayed as octets for human readability; use the integer representation for faster+cleaner comparisons.

[ Parent | on HN ]

Re:Ask HN: Can we collaborate on a IP Address or Regex black... by trinovantes on Tuesday April 06, 2021 @11:06PM (#26720156)

That's the one, thanks!

[ Parent | on HN ]

Re:Ask HN: Can we collaborate on a IP Address or Regex black... by jamal-kumar on Tuesday April 06, 2021 @11:17PM (#26720229)

That's less of a solution when you aren't able to blackhole route them in BGP

[ Parent | on HN ]