Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • I got $10K GCP bill one month because of ClaudeBot. Its likely some users were trying to replicate our software by using Claude code + chrome plugin. If I was spending $10K on traffic, I can only imagine the money cloners must be spending on tokens.
    by QueensGambit
  • It happened to me too. I got a big cloud egress bill because my game[1] is basically a mirror of thousands of Wikipedia articles. AI bots would smash all the pages so my cache hit rate was low. [1] https://redactle.net (come at me Claude)
    by pampas
  • It's too late to comment on your older posts, but I'd just like to say: it's nice to see someone making oldschool web browsers work properly on the modern web.

    https://www.sammystraus.com/#using-llms-to-make-the-emacs-we...

    by ben_w
  • I rolled my own version of Anubis for reasons*, and > 80% of all traffic is bots that fail the challenge, even when white listing legit crawlers.

    * I wanted an elixir version so I could run it alongside my existing apps instead of having it sit as a proxy in front of them. This way my existing apps can validate if the caller is already whitelisted and if not redirect to the challenger https://sphinx.8by3.com which sends you back to a site if you pass eg. https://tuhat.net

    by 8by3
  • I posted a link to an online game I made in the comments here once, and immediately got all kinds of good and bad traffic.

    Some people liked my work, found me on LinkedIn and sent a connection with a positive message. Other people tried every which way to SQL inject or attack the site, posted slurs in every available input, etc.

    Someone copied the site and hosted their own version with a couple minor changes. I only found that one because they had left one of the links in, which gave me referring traffic from their copy.

    All that from one HN comment, very much pre-AI too, not to mention the standard daily slew of requests probing for what I assume are known vulnerabilities in Wordpress or PHP.

    The internet is a floodgate of different actors, many of which are automated, and a link posted somewhere like HN opens the valve especially wide.

    by naet
  • I really recommend blocking all traffic from anything on https://github.com/borestad/blocklist-abuseipdb
    by pmlnr
  • Last year, I wrote a post about how I use zipbombs to deal with bot traffic [0]. It went mega viral over the web, and I regret it. My server was completely overwhelmed with bot traffic. After months of dealing with it, I had to find a better strategy then keep my mouth shut.

    [0]: https://news.ycombinator.com/item?id=43826798

    by firefoxd
  • There is so much spam, abuse, and aggressive scraping that I've had to block:

      - AWS
  - Google Cloud
  - Azure
  - Alibaba Cloud
  - Oracle
    and a handful of other ASNs on almost all of my properties. It would be one thing if it was simple scraping, but it's often genuine agentic abuse (just spamming for vulnerabilities* or scraping millions of pages with very little valuable or dynamic content). These clouds must get the abuse happening under their own roof under control.

    I banned Alibaba's Cloud two years ago and it still hits one of my domains 1 million times per day, despite every route 4xx-ing during that time.

    Even Apple has aggressively ramped up its scraping in the past few months, but thankfully they do respect robots.txt.

    It's frustrating because some of my real users route through these clouds via their work VPNs. Also, there are a lot of less-than-reputable AI scrapers using global bot-nets via residential IPs to scrape, making it even harder to detect and ban them without affecting real people.

    * like leaked .env routes, brute forcing admin panels, and so on

    by switz

Explore Birbla archives