Do you block using your firewall or redirect bad bots hitting your server?

Question

Tons of bad bots hit our servers every day and I have tools to instantaneously block them (i.e. modsecurity and a C++ tool of my own.) These block the bots so no data is sent back and they are banned on my firewall so any extra hit is immediately turned down. On one of my server (small one!) I get over 20 such blocks (IPs) per day and that server only gets ~3,000 hits a month.

Now, the IP block is temporary mainly to avoid crowding my firewall (1,000's of IPs in your firewall will make it really slow!)

However, I'm wondering now... What do you do on your end? Block everything at once or send the bot to la la land with a redirect? I'm thinking that I could have a tiny HTML page with nothing on it (you know, something like a title and a body which say "Thanks" and voilà).

Which do you think is best? I've seen that redirections did not seem to deter any robots so firewalling them has been my best solution so far... but I was wondering what others do in this situation?

Answer 1

It does depend on what is hitting your firewall. IME, blackholing the traffic has the best effect.

I recently had a flood of DNS queries on my domain server from a small number of addresses. Someone had decided it offered a valid enough response for a root-server query (it's not an open resolver) that it was then made available to a DDoS tool to use. A bit of discussion with the owner of one of the IP addresses showed that it was a spoofed packet and any response was going to do the intended DDoS. So I blackholed them as soon as I spotted them. They've all gone away now.

If it had been someone mistakenly thinking it was an open resolver, then sending back misleading information might have been effective. Certainly confusing!

Answer 2

A bot may not necessarily follow a redirect. It's not human, after all. In fact, if your server responds with an alternative address prompt (or responds at all), it may just ignore it and be motivated to dig deeper into your domain, or it may scrape both you and your redirect with added frenzy at getting any response at all.

The best thing you can do is block the IP once it starts behaving suspiciously (typical admin urls like php-mysql, following every single link, etc). Otherwise, just don't stress and let them do their thing. As long as your site has adequate security to block out unauthorized access to sensitive content and has frequent contingency backups just in case, you needn't worry.