[Split] Bytespider Attack

[a3035oc_web]

Split from viewtopic.php?p=15489551

Sorry to re-open such an old topic but the Bytespider access is really hitting my site ... I've tried robot.txt, the Spider/Bot config in phpBB and also .htaccess but whatever I tried they still get through ...

Most look like this:

GuestIP: 3.0.126.133 » Whois
'Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36'Bytespider;h

Seems to be AmazonAWS in Singapore & Japan.

Any more ideas?

[Mick]

It seems you’re not the only one, the suggestions I see online point towards using the ‘Report Amazon AWS abuse’ form to report suspected abuse of AWS resources. Have you spoken to your hosts about it?

[a3035oc_web]

Reported it to my hosting company but they didn't know much more that I did. I added entries to robots.txt and also used the robots/spiders entries in phpbb as well as blocking some of the common IP ranges that it was showing. But even then I was often seeing 6 or 7 anonymous entries in "Who's online".

So reported possible abuse to AmazonAWS and slowly the traffic dropped off and now I'm not seeing any (but then I don't spend all my time monitoring who is online!).

I'm assuming they had a runaway web crawler or someone was abusing their services ..

[HB]

Another option is using Cloudflare's Web Application Firewall (WAF). With that, you specify a user agent match (e.g., go to Security > WAF and add match for user agent contains "Bytespider") and it's blocked before it even accesses your host server.

[Galixte de EzCom]

The last week I encountered the same problem, I used this code in .htaccess:

Code: Select all

<RequireAll>
	Require not host .ap-southeast-1.compute.amazonaws.com
	Require not ip 47.128.0.0/16
	Require all granted
</RequireAll>

The Bytespider bot from Bytedance (TikTok) disappeared instantly.

[thecoalman]

You are blocking a range and this can be problematic if legitimate services are in that range. Specifically with AWS duckduckgo uses their services.

[HiFiKabin]

I use Jeff Stars .htaccess bad bot blocking code which is available from his site or from my extensions site where I have incorprated it into the phpBB .htaccess and added bytespider and bytedance

[Galixte de EzCom]

You are blocking a range and this can be problematic if legitimate services are in that range. Specifically with AWS duckduckgo uses their services.

This whole range is dedicated to AMAZON in Singapore, I don't care about their servers there.

I use Jeff Stars .htaccess bad bot blocking code which is available from his site or from my extensions site where I have incorprated it into the phpBB .htaccess and added bytespider and bytedance

As always, I appreciate your valuable contribution, and thank you for sharing this extension.