https://darek.dk/categories/botnet/ Recent content in Botnet on darek.dk Hugo en darek.dk Fri, 14 Feb 2025 17:17:17 +0000 https://darek.dk/posts/2025-02-14-querying-grouping-blocking-bad-ips/ Fri, 14 Feb 2025 17:17:17 +0000 https://darek.dk/posts/2025-02-14-querying-grouping-blocking-bad-ips/ If your database stores user-generated content along with client IPs, you may need a way to detect and block abusive users. A common approach is to analyze database records to identify IPs with excessive activity, group them by subnet, and apply firewall rules to mitigate potential abuse. First, we retrieve a list of IPs with multiple records over the past 21 days that exhibit patterns of potential abuse—such as frequent spam submissions, excessive requests, or other suspicious activity.