Comment the cloud makes security so goddamn tedious (Score 2) 82
My list of blocked User-Agents grows daily, from obvious bots to ancient browser versions. Can't just block the IPs because lots of useful services are using the cloud too, like getting certs from Let's Encrypt. Scientology is now hiding behind the Amazon veil, when they send mail they use somerandombullshit@aws or whatever as the envelope sender so I have to scan the DATA headers in order to block their intergalactic propaganda at the server level.
Years ago I started watching the internet static, the random port connection attempts. I started out just wanting to find and block nmap-style port scanning, but I saw all this other weird stuff and started collecting data. For a couple years there was a guy using Digital Ocean droplets to do weird port scanning. He used a different droplet for each port he would scan and he set the hostname to "a 6 letter word from a standard dictionary list"."the port number but backwards and repeated by position, like 1234 = 4332221111"."three random letters", and the source port was always 61953. He'd hit my server 4-500 times a day, but only 3 days a week, Sunday thru Tuesday. I reported him consistently until after some months they finally said "Oh, we know."
Digital Ocean at least tries to give you a programmatic way of reporting abuse, the other guys make it so onerous with long web forms with so many required fields that rarely have anything to do with your particular issue. I wish they would just hire Lily Tomlin to say "We don't have to care, we're goozurewebsandwiches.usercontent or whatever the fuck."
