[geeks] HTTP GET with method?

[Jonathan Patschke]

On Tue, 19 May 2026, Mouse via geeks wrote:

> Recently, I've been seeing numerous disparate hosts asking for /ip,
> temporally coordinated in a way that makes me reasonably sure it's a
> botnet or something like it.

Almost certainly.

>> I tried an HTTP tarpit, and that kept them busy.  For a while, I had
>> 8000 of them connected, downloading random trash at 0.1 bytes/second,
>> and I kept having to add new subnets to the deny-list.
>
> I've been tempted to set up something like that, but it seems to me
> that for my purposes it's more effective to border-block them; I see no
> reason to talk to botnet members over any protocol.

I use tarpits probatively.

If I set up a tarpit, and the same host with several downloads in my
server logs also hits the tarpit several times concurrently, I block
them because I'm just burning resources otherwise.  However, if I set
one up and it gets stuck, I assume (possibly over-confidently) that the
thing on the other end is running poorly-written garbage that is dumb
enough to just sit there.  I'll happily burn a few kilobytes of memory
and almost no bandwidth to render a misbehaving host toothless.

Watching them blow up as they downloaded gigabytes of ASCII art (at a
disproportionately low cost to me) was _glorious_.

-- 
Jonathan Patschke
Austin, TX
USA