Cloudflare Developers•3y ago

If you don't want do block users then you can always use managed challenge

CCyb3r-Jak3 If you don't want do block users then you can always use managed challenge

captain•10/15/23, 9:10 PM

besides some sort of homemade VPN, woiuld a real user EVER be coming from amazon aws

Ccaptain besides some sort of homemade VPN, woiuld a real user EVER be coming from amazon...

Cyb3r-Jak3OP•10/15/23, 9:12 PM

My company has VPN servers which we host in AWS so yeah. Most people have it split tunnel unless they are traveling for work in which case it is full tunnel

captain•10/15/23, 9:13 PM

i use S3 for images

Original message was deleted

captain•10/15/23, 9:13 PM

agreed. AI scrapers can get past it and I've seen other scripts in github

captain•10/15/23, 9:13 PM

(that i have reported to cloudflare)

captain•10/15/23, 9:14 PM

i use s3 for images, and then the majority of bad bots are coming from amazon...which then in various ways increases my s3 costs...this should be illegal

captain•10/15/23, 9:15 PM

amazon should be fined for this, they could EASILY stop this...but they are profiting from this

Original message was deleted

captain•10/15/23, 9:16 PM

i'm using https://wordpress.org/plugins/amazon-s3-and-cloudfront/ for many years, they don't support R2 yet

Plugin DirectoryWP Engine

WP Offload Media Lite for Amazon S3, DigitalOcean Spaces, and Googl...

Copies files to Amazon S3, DigitalOcean Spaces or Google Cloud Storage as they are uploaded to the Media Library. Optionally configure Amazon CloudFro …

Original message was deleted

captain•10/15/23, 9:17 PM

i set up a separate business account for images because the captcha on managed challanges was messing things up, so no managed challenged on my serpaate image account which is set up with cnames to the s3 urls.

captain•10/15/23, 9:18 PM

and then edge caching the image for 30 days

captain•10/15/23, 9:18 PM

but last couple months prices for the s3 have gone way up and haven't dived into to check

captain•10/15/23, 9:19 PM

but that said...amazon not allowing this behavior, making to much friction to report, and not being on top of things is making them ore money and costing me..and probably others...money and contributing to the dead internet.

captain•10/15/23, 9:19 PM

they should be penalized for this

captain•10/15/23, 9:19 PM

agreed?

captain•10/15/23, 9:20 PM

or am i crazy..

captain•10/15/23, 9:23 PM

i actually like my set up

captain•10/15/23, 9:23 PM

the main issue is stopping the crime

captain•10/15/23, 9:26 PM

but...i guess i'm alone on this

captain•10/15/23, 9:45 PM

amazon gives an IP range of this:
"ip_prefix": "54.174.0.0/15",
"region": "us-east-1",
"service": "AMAZON",
"network_border_group": "us-east-1"

captain•10/15/23, 9:46 PM

however cloudflare waf wont block 54.174.0.0/15

captain•10/15/23, 9:46 PM

the 15 needs to be a 16

captain•10/15/23, 9:46 PM

is that the same thing..?

captain•10/15/23, 9:46 PM

going through their IP ranges now: https://ip-ranges.amazonaws.com/ip-ranges.json

Ccaptain however cloudflare waf wont block 54.174.0.0/15

Chaika•10/15/23, 9:50 PM

why not? Make sure you use the inin operator. If your goal is just to block all of Amazon, you could just block them by their ASN 14618 .

the 15 needs to be a 16

No, a /16 is 256 /24's and a /15 is 512 /24's, you'd be blocking half the space

CChaika why not? Make sure you use the `in` operator. If your goal is just to block all ...

captain•10/15/23, 9:50 PM

why does cloudflare not allow /15

captain•10/15/23, 9:51 PM

in the waf...just curious

Chaika•10/15/23, 9:51 PM

what do you mean?

Chaika•10/15/23, 9:51 PM

a custom rule accepts it fine, not sure what you're doing

captain•10/15/23, 9:51 PM

when using the WAF, IP Access Rule

captain•10/15/23, 9:52 PM

it says: Only an IPv4 range (CIDR) value of /16 or /24 is allowed for IP Access Rules. Use Firewall Custom Rules and IP Lists instead.

captain•10/15/23, 9:52 PM

dash pic

Chaika•10/15/23, 9:54 PM

Some speed thing maybe? Those are right on the edge of the octet, /16's are network.network.host.host, /24's are network.network.network.host

Chaika•10/15/23, 9:54 PM

IP Address Rules are really old though, I would follow its suggestion, you could use a custom rule it or use IP lists

CChaika Some speed thing maybe? Those are right on the edge of the octet, /16's are netw...

captain•10/15/23, 9:55 PM

that's gonna be a bit of time..but you are right

captain•10/15/23, 9:56 PM

54.195.114.186

captain•10/15/23, 9:56 PM

which traces back to amazon ireland i guess

captain•10/15/23, 9:56 PM

AS16509 AMAZON-02

Original message was deleted

captain•10/15/23, 9:57 PM

AS16509 AMAZON-02 is this a real amazon asn and do you know of a list for all amazon asn's?

Original message was deleted

captain•10/15/23, 9:59 PM

got it thanks

Chaika•10/15/23, 10:00 PM

they've got an AS List (as-amazon) you can jump into and find all of their ASNs: https://bgp.tools/as-set/ARIN::AS16509:AS-AMAZON
Not sure all are used for customer stuff though

AS-SET AS16509:AS-AMAZON - bgp.tools

CChaika they've got an AS List (as-amazon) you can jump into and find all of their ASNs:...

captain•10/15/23, 10:02 PM

nice. would block AS16509 would block everything listed in https://bgp.tools/as-set/ARIN::AS16509:AS-AMAZON

AS-SET AS16509:AS-AMAZON - bgp.tools

Chaika•10/15/23, 10:02 PM

nah that's just one of their ASNs, each one in that list is a separate ASN

CChaika nah that's just one of their ASNs, each one in that list is a separate ASN

captain•10/15/23, 10:03 PM

got it

Chaika•10/15/23, 10:07 PM

There are trade offs with everything, the more you block, the more innocent people you will block that come from Amazon/etc ASNs due to company VPNs and such

Chaika•10/15/23, 10:11 PM

imo the way Google and other big websites deal with attacks and such (at least against static assets/non-abusable things like loading home pages) is the best, just absorbing them with capacity rather then trying to play a game of whack a mole. Cloudflare makes this possible pretty easily with caching, rate limiting rules and such, and then for bigger abusers you can serve challenges based on IP Rep and stricter rate limits on specific endpoints, accepting the fact that some bots/etc will always get through, make it a bit harder, but not hard enough to potentially give any real users too much of a hassle

CChaika imo the way Google and other big websites deal with attacks and such (at least a...

captain•10/15/23, 10:18 PM

i get that, but my opinion to add to that is that if Amazon has a bunch of fraudulent actors on their system, they could be doing alot more to remove them and report them to the FBI

captain•10/15/23, 10:18 PM

i have all the IP's that lead to a payment source and to a login of a user that they have access to

captain•10/15/23, 10:19 PM

they could then monitor the traffic, find other bots doing the same traffic and take it down

Original message was deleted

captain•10/15/23, 10:20 PM

don't they have to have a funding source?

Original message was deleted

captain•10/15/23, 10:21 PM

that might true...but that is still fraud that they could stop, the onus isn't on me or cloudflare, its on the company running the server

If you don't want do block users then you can always use managed challenge

Similar Threads

Similar Threads

Similar Threads