It says I've been blocked when I try to view that. Not on a VPN.

Are you in a safari browser?

Chrome android

The site runs off of a tiny little server at home so I’ve got some very aggressive firewall rules. Anything from the usual bad countries, certain signatures etc are blocked. Reduced traffic to 1% of previous load.

What are the bad countries? Russia and china?

There are no bad countries, only bad streams of traffic.

Some of which have been observed to be associated with certain countries.

I believe even a cursory examination of recent history to show your premise to be less than truthful.

There are bad actors. There are bad groups of actors. There are bad political regimes of groups of bad actors. There are countries made up of bad political regimes made up of groups of bad actors.

If you spend any time at all at a cloud hosting provider, you'll quickly learn there are only a few bad countries. It's not really Russia IME, it is mostly India and China. If you block those two, you're going to eliminate 99% of your abuse.

I'm curious, what's the method you chose to block them? Do you use some IP list provided from some geolocation service?

I'm in silicon valley in the USA on Comcast lol

That fits the usual bad countries filter alright.

No way, that is a cool fucking captcha!!

Cool as a one-off use on some random blog contact form. Infuriatingly annoying if used somewhere you have to solve it with any frequency.

Cool, sure, good, probably not. I've never played Halo so I didn't entirely know what I was doing (do I shoot the blue guys too? it's not letting me through so I guess I do), and I don't doubt people couldn't even get what it meant by shoot. And god forbid anyone with disabilities that affects their mouse accuracy, or needs a screen reader tries to use it

Haven't looked at the devconsole but it'd probably be easily bypassed by someone dedicated.

Agree on the first part, but for the second... I think it depends on what your threat model is.

If you want to stop a dedicated attacker ready to spend time to attack your site, it won't work, but nothing will. If you want to stop a generic bot going over the internet and submitting all forms it finds with spam, this will work, and might even work better than wide-spread solution for which the bot has a countermeasure.

It has the advantage of being novel for the user rather than doing the same Google/Cloudflare/... CAPTCHA for the 10th time that day.

Reminds me of the Doom captcha.

https://vivirenremoto.github.io/doomcaptcha/

99% certain this is where I copied the idea from.