1

I have a list of bot (traffic) IPs (around 6000). I'm able to block them when buying traffic to my sites.

193.154.239.54
84.56.102.50
92.105.183.21
193.83.238.7
212.95.5.170
92.211.215.128
93.214.99.1
88.152.186.12
etc....

I can see many of the IPs are almost the same and only last IP numbers are different.

So my question is when I'm blocking IP ranges that I want to block, what range should I put so that I completely don't stop traffic but still block the majority of bot-traffic).

Currently I'm doing 255 (range blow), but I feel it's too much since I block over 1.2M IPs

193.154.239.1/255
84.56.102.1/255
92.105.183.1/255
193.83.238.1/255
212.95.5.1/255
92.211.215.1/255
93.214.99.1/255
88.152.186.1/255

Any feedback would be appreciated!

  • I wouldn't arbitrarily block an entire subnet because some of the IP are from bots as there is way too high of a chance you would just be blocking legitimate users. Though if you still do want to block these IPs you could input the actual range to block in the iptables rules of the known bot IPs and not just block the entire subnet those IPs are part of. This answer shows an example on how to block a range using IP tables. – Analog Apr 25 '18 at 18:12
  • "when buying traffic to my sites" - buying traffic? – DocRoot Apr 26 '18 at 0:08
  • 1
    Blocking bots using IP blocks requires a certain level of expertise. I would not recommend that you take this on. Instead, you can use Fail2Ban or mod security and let these apps handle the process for you. Fail2Ban is likely the simplest since it maintains many recipes and lists for you. There is a recipe for bots specifically. Still, neither is for the faint of heart. You will need to read the docs. – closetnoc Apr 26 '18 at 0:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.