Is there an easy way to block any requests originating from VPS etc instead of residential/commercial IP from legitimate users ? I know cloudflare does a few things but I really want to figure out a way to block any request say at nginx or caddy (reverse proxy) from reaching origin servers if they are not from an IP that is not a VPS etc.

▲

djkurlander an hour ago | parent | next [-]

I run an open source honeypot that collects these botnet scans and produces blocklists.

Blocklist download and configuration: https://knock-knock.net/blocklist

Honeypot dashboard, where you can see attempted attacks in realtime: http://knock-knock.net

API: http://knock-knock.net/api

▲

basilikum an hour ago | parent | prev | next [-]

> /commercial IP from legitimate users

No, because legitimate users do not just use residential and "commercial" IPs. Like me, right now

▲

VladVladikoff an hour ago | parent [-]

You are the 0.001%

	▲	basilikum an hour ago \| parent [-]
		Much more than 0.001% of people care about their privacy or (the larger portion) do not have unfiltered access to the internet.

▲

VladVladikoff an hour ago | parent | prev [-]

Yes but it’s not cheap. Maxmind and ipinfo etc sell a tier that tells you this information, then you can 403 based on it. But the price is nuts like $40,000 a year.

▲

sparkling a minute ago | parent | next [-]

Focsec.com IP database for offline use (datacenters, VPNs, proxies, bots) runs around $1k/month for internal-only use.

▲

KomoD 40 minutes ago | parent | prev [-]

You don't need to spend anywhere near $40k a year to get that info... You don't even need to spend $1

	▲	gavinhking 14 minutes ago \| parent [-]
		What's your strategy?