Any downside to blocking all of China?

subpop138 · Jul 7, 2015

I've been working on a newer authority site for a few months now. When I check the traffic I usually see 50-100 hits from a Chinese IP all in the same day. So I then manually block that IP. Next day, same thing from a different Chinese IP. No matter how many specific IPs I block, China is still up to something. Now I just want to block the whole country.

This site is entirely in English and there's no legitimate reason for this traffic.

Has anyone had any unforeseen negative issues blocking an entire country?

lancis · Jul 7, 2015

I block Chinese & east Ukrainian traffic on a constant basis. No negative issues so far.

p.s. For those wondering why - most of the SSH brute-force attacks come from these countries.

cottonwolf · Jul 7, 2015

Don't forget India as well. I've got plenty of dumbbots at my ssh gates from Indian ips. Nothing personal.

lancis said:
I block Chinese & east Ukrainian traffic on a constant basis. No negative issues so far.

p.s. For those wondering why - most of the SSH brute-force attacks come from these countries.

firstnamelastname · Jul 7, 2015

If there is no reason someone from those countries should visit your site, then block them.
I would like to block India, China, Ukraine, Russia, Pakistan, Phillipines, Bangladesh
But the question is, how do you block all this without slowing down your site? because if you add all these IPs to your htaccess, your site will get slow as hell because it has to process all these commands before the site loads (right?)
The next question is what about false positives? what if someone is in the US but their IP for some weird reason resolves to India?

Capo Dei Capi · Jul 7, 2015

Why not hardened your website instead of worrying about people from certain countries?

ladieshustle2 · Jul 7, 2015

If you have no real significant gains from that Chinese traffic, then it would make sense for you to go ahead and block that traffic. But it's obvious that doing so, your significant traffic sources MAY suffer from a potentially slower site - yes because of commands.

Test it out for a week and see what happens.

lancis · Jul 7, 2015

firstnamelastname said:
But the question is, how do you block all this without slowing down your site? because if you add all these IPs to your htaccess, your site will get slow as hell because it has to process all these commands before the site loads (right?)

Add them to firewall rules instead .htaccess, and there will be no noticeable slowdown.

STKMKTFTGRU said:
Why not hardened your website instead of worrying about people from certain countries?

This is part of "hardening" your website. There are thousands of Chinese IPs that attempt to brute force your password. They are not targeted. They scan IP ranges and attempt to guess the passwords of the root users. If you dont block them, eventually they will find the password they are after.

Sure you can block these IPs only, but as I said there are thousands of them and they change as the time goes by. So the best strategy is to block the entire country (especially since that country is of no relevancy to you).

elfgirl · Jul 7, 2015

clearly if you are selling to only US or Canada then there would be no reason to have traffic from those countries. So I say it could only do good for you.

67MAD54 · Jul 7, 2015

China and Russia are two of the main culprits with hack attacks on my sites

Ohboyj · Jul 7, 2015

No more wanton soup & fruity loops

Capo Dei Capi · Jul 7, 2015

lancis said:
Add them to firewall rules instead .htaccess, and there will be no noticeable slowdown.

This is part of "hardening" your website. There are thousands of Chinese IPs that attempt to brute force your password. They are not targeted. They scan IP ranges and attempt to guess the passwords of the root users. If you dont block them, eventually they will find the password they are after.

Sure you can block these IPs only, but as I said there are thousands of them and they change as the time goes by. So the best strategy is to block the entire country (especially since that country is of no relevancy to you).

Use really long passwords and really long root usernames and it will be nearly impossible to be hacked.

Neocortx · Jul 7, 2015

lancis · Jul 7, 2015

STKMKTFTGRU said:
Use really long passwords and really long root usernames and it will be nearly impossible to be hacked.

Even better, use public/private key pairs instead passwords. But you're forgetting that some website have registered users, who tend to choose weak passwords. Have software vulnerabilities that might be abused by the SSH bots, etc, etc. Blocking the country is still the cleanest solution of them all.

Any downside to blocking all of China?

subpop138

Junior Member

lancis

Elite Member

cottonwolf

Regular Member

firstnamelastname

Regular Member

Capo Dei Capi

BANNED

ladieshustle2

Newbie

lancis

Elite Member

elfgirl

Regular Member

67MAD54

Power Member

Ohboyj

Junior Member

Capo Dei Capi

BANNED

Neocortx

Regular Member

lancis

Elite Member

Main Menu

Marketplace

Making Money

BlackHat World