Title: Hi all,<p>I run a pretty popular site that is constantly experiencing some form of abusive traffic- most notably attackers running password dumps against our login endpoint (sometimes from 10k+ ipv4 addresses among several subnets and ASNs).  We&#x27;ve mostly mitigated this with rate limiting, captcha and other forms of &quot;suspicious login&quot; detection. But I&#x27;ve been recently pondering ways to waste their time or resources to make password dumping less appealing.<p>The most recent attack could be accurately and precisely detected, and I noticed the abusive traffic would follow 301 redirects, so I decided to redirect all requests back to their own IP addresses.<p>I don&#x27;t think it really slowed them down, but got me thinking of otherwise to stop&#x2F;slow them down:<p>* 301 redirect them to a &quot;honeypot&quot; server that holds onto sockets for as long as possible and&#x2F;or causes the client to waste time&#x2F;cpu cycles (perhaps, constantly asking the client to renegotiate TLS)<p>* 301 redirect to https:&#x2F;&#x2F;nsa.gov so they might get on someone&#x27;s radar with the time and resources to stop them<p>* Redirect them to a non http protocol, like geo:, potentially blocking the abusive client with a dialog &quot;Want to open this with &lt;Maps Application&gt;?&quot; (Some attacks originate from Android devices- I&#x27;m not sure how deeply the custom protocol hooks are registered and if that would even work)<p>I know abusive web traffic is pretty widespread and was curious how others dealt with it other than standard captcha, rate limiting and iptables rules
Upvote: