Re^2: Anonymous Google Chrome browsers now under additional scrutiny

[LanX]

Well yes, a node behind the honeypot could automatically block the IP.

But probably it's better to redirect blacklisted IPs to some static and link-wise shallow fake content to feed them a little. ¹

Otherwise HTTP-Errors are easily detected, so someone might be triggered to improve the attack.

From my understanding they are using IP-farms to attack us and share the harvested links among them for the next requests. Like that we might trap far more IPs in our "honeyfarm"

¹) like a wget-mirror of the last week in a dedicated node-id range, there is a huge unused gap there, which we could reuse.

[cavac]

Hmm, for some (other) attacks on my server, my backend actually grabs the WHOIS information and tries to extract the network range, which then gets iptabled.

Of course, for my private server i can be a lot more aggresive in blocking large swathes of the internet.