@beeoproblem @sammypanda @mattly Those things are the plague. Websites are hit by continuous scraping from a huge number of domestic IP addresses. This creates errors, causes slowdown, and is nearly impossible to block.
@mike805 @beeoproblem @mattly yeah and it's weird traffic too in my experience, like stuff that immediately makes me think its a bot. It's also very often mobile internet.
Aug 1, 2026, 1:46 PM@sammypanda @mike805 @beeoproblem @mattly that's because these botnet companies develop and publish "SDKs" that mobile app developers, especially of 'free' apps, are paid pennies to integrate into their apps in the same way that they integrate advertising (and now often integrate both)
Aug 1, 2026, 1:47 PM@sammypanda @mike805 @beeoproblem @mattly so basically that 'free app' off the play store may quite possibly be ddosing websites on behalf of an "ai" company
Aug 3, 2026, 2:07 PM@joepie91
Yeah, I regularily receive “partnership offers” for some (mostly desktop) software I develop too. They just scrape the download stats and contact info, then send me messages how “much” money I could make based on that.
I really hope we never become desperate enough for me to seriously consider accepting. But since we have no income to speak off...
@sammypanda @mike805 @beeoproblem
@curiousicae @joepie91 @sammypanda @beeoproblem Here's my project that isn't making me any money: https://TheUnCloud.co/ video, screen sharing, file transfer and chat without cloud storage. Uses WebRTC so it's not costing me much either, and it has no commercial malware.
@mike805 @beeoproblem @sammypanda @mattly "have you heard about my today's sponsor *VPN? "
@alesroubicek @beeoproblem @sammypanda @mattly I'd like to see the residential ISPs detect this sort of thing and throttle the customers to about 56K until they remove whatever is hosting the malware.
Either that or there needs to be a Spamhaus-like blocking service so the customers are denied access to pretty much everything. Put the problem back on the fool who is running a Kodi box (or a Walmart special TV, not much difference.)
Have you found a good way to block this stuff?
@mike805 @beeoproblem @sammypanda @mattly I didn't, I have my sites behind CDN and hope they have the capital to deal with it.
Aug 1, 2026, 7:00 AM@mike805 if you find it useful, I use go-away (https://git.gammaspectra.live/git/go-away), rules ramped up for checks on blog posts that usually cans out the bots. On the firewall I also pull a blocklist from AbuseIPDB.com, for the most part it will catch scrapers in the net.
I've not yet worked out a way to calculate failed challenges for an IP then report them in to AbuseIPDB from go-away to rat on them
@mike805 Do you you have a reference how Kodi is affected by this botnet/proxy topic?
@6N3my6 https://www.kaspersky.com/blog/android-tv-botnet/55799/
https://www.eff.org/deeplinks/2026/06/primed-malware-stop-selling-compromised-android-devices
Kodi itself is fine, but the packages installed on those TV boxes are not.
@mike805 Thank you, interesting topic. But no mentions of Kodi in your links.
@6N3my6 These TV boxes almost all use Kodi as the basic user interface, and are sometimes generically called "Kodi boxes." They are generic Android platforms that often come preloaded with (or download on first use) a bunch of pirate streaming apps. Many of them also come preloaded with residential proxy malware.
No insult to Kodi as a project intended.
@mike805 Now that makes it clear to me, thank you. Wasn't aware some of these pre-configured boxes are based on Kodi.
@mike805 @alesroubicek @beeoproblem @mattly absolutely! my shower thought was how ISPs are majorly guilty for the issue. Bad oversight, ISP culture that doesn't care about IP reputation for some reason, CGNAT and anything else that allows IPs to be so ephemeral when they were really supposed to be... an address to you, but now they might as well just be considered purely for routing having been all been rentified. Also IANA doing nothing too. Without proactiveness on the issue IPv6 will be used exactly like this enshitifed IPv4 and that would be catastrophic.. an unbelievable amount of IPs to just cycle around and be careless with. It should be a way bigger concern for IANA, ISPs and governments that IPs are not doing what is on the can by the person they are rented to. There should be something to indicate that traffic is behind a proxy, something like the ISP/router could put a proxied traffic likely flag if there is incoming connections that match the volume of outgoing from the local ip it's assigned to + ways to prove that pattern is something other than a proxy if the user doesn't want the mark on their outgoing. But, there is really barely anything like that in the core design, it's all still pretending like there's only 1000 people on the internet lol; deferring all the reputation and usability of the internet to downstream services $$$, dynamic lists, cloudflare: lord of the modern internet, and the application layer. Rant +1
@alesroubicek @mike805 @beeoproblem @mattly oooh i didnt even think, i was thinking dodgy mobile apps and such.. of course commercial VPNs; that is so twisted cuz you'd think as a user that this is when your IP is *not* being used. But these somewhat have excuses for all the proxy related libraries.
Aug 1, 2026, 6:53 AM@mike805 right ! I've been watching my logs on my frontend, when a LLM scraper is blocked by my server trying to rip a blog post, as soon as it gets dropped or a 403 out of nowhere at least five retail IPs will come at it. Always a blog post from 2006 that has zero views, so not like it has something legit
Aug 1, 2026, 6:59 AMAug 1, 2026, 7:07 AM@ln yep, getting the rules right is a little bit of trial and error so the initial start will need a decent amount of time.
Otherwise you'll either be letting bots slip through or blocking people. Having a tarpit helps as well to feed a custom list of IPs to be dropped