[geeks] HTTP GET with method?

[Jonathan Patschke]

On Sat, 25 Apr 2026, Mouse via geeks wrote:

>>> HTTP/1.1'' from 14.255.31.77 to port 80
>> That IP looks to have a clean reputation according to my tooling.
>> Doesn't mean that much [...]
>
> Oh, the source IPs are all over the place.  Because these are tripping
> my automated defenses, each IP is getting only one crack per week at
> me, but I'm still seeing significant numbers of them, on a par with the
> number of hosts requesting /ftp/... or /crawl/... (both of which used
> to exist, but haven't in years; crawlers seem _really_ slow to grasp
> the notion that they're gone).

I had that problem last month when these things where hitting a machine
that's the caching frontend to a hierarchical storage system where
retrievals cost me actual money.  They weren't pummeling, but they were
diligently coordinating a crawl of the whole thing.

I tried an HTTP tarpit, and that kept them busy.  For a while, I had
8000 of them connected, downloading random trash at 0.1 bytes/second,
and I kept having to add new subnets to the deny-list.

What made them go away was much sillier than that.  Once I realized they
were using a predictably nonsense user-agent, I could have apache itself
treat the bad actors with mod_rewrite.  They each got the same file: a
very rude piece of ASCII art, concatenated to 10GB, brotli-compressed
down to 800K with the right "Add-Encoding" response header to tell the
client how to unpack it.

AFter each host completely downloaded the file no more than three times,
it would drop connection mid-download.

This file is now my standard response to requests for .htpasswd, .env,
and so on.

-- 
Jonathan Patschke
Austin, TX
USA