I have a problem with Chinese flood bots qq.com bots

Question

we are running linux debian dedicated server for our website...

I have a problem with CHINESE bots qq.com bots they are connecting to my website all the time. about 5000 - 10.000 different IPS .. they give me about 15-25 GB of bandwith per day of usage could this be giving issues to my website for slower loading ??

what would be the best thing to block complet china country from connecting to my website ? i have read many forums on how to do this also i have checked this website https://www.howtoforge.com/nginx-how-to-block-visitors-by-country-with-the-geoip-module-debian-ubuntu for somehow i am unable to get this to work for me on my website i have done all what the website tells you to do and i have tryed to block "US" country and i used a vpn to connect to my website to see if i would get redirected but i could visit the website normaly so its not working...

also the problem is the list GeoLiteCountry , GEOIP - downloading from the websites everywhere the link is unavaliable anymore - anyone has any idea on how to get a valid up to date country IP-LIST

what is the best free software i can use to monitor bandwith daily and how could i get an output option also on which-country ips are connecting to my website and how many per day thanks

I think you have use Web firewall like Sucuri or cloudflare – Amit Bera Feb 16 '20 at 14:17 — Amit Bera, Feb 16 '20 at 14:17

score 0 · Answer 1 · answered Feb 16 '20 at 14:28

0

You have to implement

List item
enable captcha or use google captcha
Write server side validation for qq.com email id.
Using htaccess block that IP
installed GeoIp and using htaccess block china country.
Mobile or Email OPT verification before create account.

I hope so above is helpful for you.

answered Feb 16 '20 at 14:28

Sweety Masmiya

1,371
10
21

captcha is enabled everywhere this is not a problem - the problem is the bots are still connecting to the website and by doing that they create unnecessary bandwith .... – Bizzon Feb 16 '20 at 16:31
registration is CAPTCHA enabled already – Bizzon Feb 16 '20 at 16:31
i am not using APACHE server but NGINX i cannot block through htaccess – Bizzon Feb 16 '20 at 16:31
where to find latest GeoIp .dat list ??? – Bizzon Feb 16 '20 at 16:32

score 0 · Answer 2 · answered Feb 26 '20 at 07:36

always use firewall to block ip/cidr or country. like hardware firewall with your hosting provider or local software firewall installation like CSF Firewall.

https://configserver.com/cp/csf.html

NEVER use http/webserver app to block.

in CSF Firewall /etc/csf/csf.conf you just enter this:

CC_DENY = "CN,HK"

install ipset module to keep millions ips in iptables without any performance degradation.

apt-get install ipset

enable it csf firewall:

LF_IPSET = "1"

then enable blocklist, it will ban every bad ip from honeypots list with weekly updates:

sed -i "/|0|/s/^#//g" /etc/csf/csf.blocklists

then also it has lots of features to enable traffic and connections tracking, and will ban any ip that opens more connections than you define. etc

you will have to check your open ports and other ip connections and whitelist their networks.

this is how to install latest geoip database: https://blog.configserver.com/?p=3564

Due to MaxMind changing their free download policy to require signup and a license key, a new option MUST be configured to continue to use Country Code lookups (CC_LOOKUPS). The option MM_LICENSE_KEY must be set to the key obtained from the MaxMind site. See: https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases/

https://www.maxmind.com/en/geolite2/signup

I have a problem with Chinese flood bots qq.com bots

2 Answers2