Re:Aggressive bots ruined my weekend
by marginalia_nu on Wednesday October 29, 2025 @01:23PM
(#45750072)
Open port 80 and log the results. Even if you don't announce your service anywhere the baseline request rate is way above 2 rpm.
Every open port of every IP is continuously scanned for exploits.
It's understandable in your case as you have traffic coming in constantly, but first thing that came to my mind is a loop of contant reboots - again, very unlikely in your case. Sometimes such blanket rules hit me due to most unexpected reasons, like the proxy somehow failed to start serving traffic in the given timeframe.
Though I completely appreciate and agree with the 'ship now something that works now' approach!