alt Hacker NewsI posted to HN, and then my website was flooded with AI bot traffic
Comments
Last year, I wrote a post about how I use zipbombs to deal with bot traffic [0]. It went mega viral over the web, and I regret it. My server was completely overwhelmed with bot traffic. After months of dealing with it, I had to find a better strategy then keep my mouth shut.
I really recommend blocking all traffic from anything on https://github.com/borestad/blocklist-abuseipdb
I posted a link to an online game I made in the comments here once, and immediately got all kinds of good and bad traffic.
Some people liked my work, found me on LinkedIn and sent a connection with a positive message. Other people tried every which way to SQL inject or attack the site, posted slurs in every available input, etc.
Someone copied the site and hosted their own version with a couple minor changes. I only found that one because they had left one of the links in, which gave me referring traffic from their copy.
All that from one HN comment, very much pre-AI too, not to mention the standard daily slew of requests probing for what I assume are known vulnerabilities in Wordpress or PHP.
The internet is a floodgate of different actors, many of which are automated, and a link posted somewhere like HN opens the valve especially wide.
I got $10K GCP bill one month because of ClaudeBot. Its likely some users were trying to replicate our software by using Claude code + chrome plugin. If I was spending $10K on traffic, I can only imagine the money cloners must be spending on tokens.
It's too late to comment on your older posts, but I'd just like to say: it's nice to see someone making oldschool web browsers work properly on the modern web.
https://www.sammystraus.com/#using-llms-to-make-the-emacs-we...
I rolled my own version of Anubis for reasons*, and > 80% of all traffic is bots that fail the challenge, even when white listing legit crawlers.
* I wanted an elixir version so I could run it alongside my existing apps instead of having it sit as a proxy in front of them. This way my existing apps can validate if the caller is already whitelisted and if not redirect to the challenger https://sphinx.8by3.com which sends you back to a site if you pass eg. https://tuhat.net
I am trying to do the same thing, but on purpose for https://notforhumans.pages.dev/
In server logs you can distinguish the type of LLM's traffic. OAI-SearchBot/GPTBot/ClaudeBot is just indexing but ChatGPT-User/Claude-User etc. may be valuable traffic generated by user's conversation with LLM's. So it's worth choosing which ones you block, instead of blocking all of them.
I have tried a ton of stuff (Cloudflare, Anubis, fail2ban...) to combat the bots lately, but they all have their downsides, and users complained too much, so I just gave up. You simply can't win this arms race.
So I have resorted to performance improvements on my server and serving every single request. Things are way smoother now.
It's unfortunate that this also just leads to port scanning and huge accidental bills. This happened in the past to more than one acquaintnace of mine; go and market their vibe-coded/OS project on HN + twitter and then suddenly the vercel bill goes through the roof with bots scraping the website to bits, even with bot protection from CF. Really hard to get away from it these days, but hopefully over the next few years some new startup will raise $50M for "killing cloudflare" and will actually follow through!
I used to roll my own (respectful) scrapers. AI and vibecoders have ruined it for me. Everyone has super sensitive rate limiting and not checking now.
I posted a link to HN a few days ago that got literally zero upvotes and zero comments (Applying NASA's satellite-imaging trick to ancient museum objects https://news.ycombinator.com/item?id=50023128) and it was hit with insane bot traffic. HN was the only place I had posted it.
> I won't name names, but I looked them up, and they describe themselves as a service that listens for changes to a website, and then summarizes them into an AI slop news letter. And by 'listens to changes' I mean query our website many many times per-minute. Blocked.
That sort of behavior would justify a name and shame imo
Inconsiderate shitty services don’t deserve the politeness of protecting their name
I'm trying to understand the reasoning behind the entity that was sending presumably hundreds or thousands of requests per minute to the same page. It's some kind of AI news site, so it makes sense they want the freshest content, but it sounds like they were doing many requests per second, so that can't be the reason?
Oh is that why I keep getting those ai emails about the project I posted earlier?
> my website is built as a single-page-application
There you go. Ditch it. Make you pages cachable as much as you can.
Oh, as soon as you add tls to your subdomain, the bots come. It’s instant.
Have you tried dealing with bots using CF Turnstile? Ref: https://www.cloudflare.com/products/turnstile/
if you want the site to be fast, don't render it with javascript and take a look at the google lighthouse check for things to improve:
https://pagespeed.web.dev/analysis/https-sprinklz-io/bmc4mv1...
I've been posting about this recently but I continue to be bad at either timing my submissions or titling them. I struggle with YouTube thumbnails too so I think it might be me. But anyway:
I experienced the same thing after submitting articles from my small photography website. I did debate using some of the off-the-shelf solutions like Cloudflare, Anubis, or iocaine, but I ended up building my own L7 proxy that utterly fucks the bots up: https://robertmay.photography/journal/bwbach-my-guardian-gob.... I will make it generally available at some point once I get it optimised how I'd like, but currently I'm able to trap about 3000 concurrent crawlers in my tarpit of slow requests on two small Hetzner VMs. And that 3k is really just the limits of the networks hitting my servers right now, I think it'll go significantly higher than that.
I haven't really seen anyone else combat them this way, possibly because many of the standard proxies and servers are set up for fast requests, not serving them as slowly as possible. Deliberately serving page loads for as long as the requester will accept packets turns out to be a really funny way to stop the botnets - when I just rejected the requests they in turn hammered my server even harder. By tanking the request volume with a ridiculous BEAM-based proxy you can reduce their request speed to a crawl and I'm fairly certain a couple of them have blacklisted my server now.
What confused me most about this is that the entire site is, apparently, a single page (there's no sitemap that I can use to verify this; there IS an RSS file which appears to confirm it) containing all posts. Links at the top (headed "Table of Contents") are all in-page links.
At first, I assumed this was a single blog post, especially with a "Table of Contents" at the top. I guess it's following some old-school blogging conventions, but AFAICR, even those sites retained individual pages for separate posts.
I get llm-like traffic on domains with zero web content (never was, probably never will be any).
Just merely existing will get you scanned these days.
I wonder if this is why I see so many YouTube links posted under ‘new’ that never make it to the FP. Is this a way to get bot scraped and boost views/interactions?
Interesting, thanks for sharing.
>So I took a look at some data. I added top-level logging for every endpoint (how many times was a request made to each url path), and I found that a majority of the requests did not even make an attempt to fetch news articles! For reference, my website is built as a single-page-application, and what this means is that a majority of the requests did not even run the javascript necessary to render the page (!).
So you got hammered by curl requests! But isn't that part of your delivery static anyway? Were you regenerating the same HTML over and over?
>many, many requests per minute?
How many was it?
Also interesting that it was a single "user". (user-agent?) Did it come from a different IP every time?
But hey. Silver lining: free load testing! ;)
I ran into similar problems. My analytics became so useless that I threw them out.
That is primarily why websites only TLS-negotiates for server-side-only ChaCha-Poly.
love the simple css of this. very tasteful and beautiful, even if its just simple.
Same with me, every-time I got 1st page I got a lot of robots
Wait until you answer in "Ask HN: Who wants to be hired?" and start receiving hiring phishing emails.
Try posting something viral on Mastodon. The logs clearly show that it isn't the most efficient social network.
happened to me too!
Ok, on the one hand to have one bot hitting your website to populate some kind of slop newsletter is pretty annoying.
On the other hand, “multiple times per minute” doesn’t seem that high? Even if it was 60x per min that’s fully within the limits of what a 2015 laptop in the closet can handle.
Heh. I posted a GitHub project Show HN, a couple of days ago, and it never even made it out of new, but it got me some bots.
That's a big reason that I never post any of my apps here.
Welcome to hell, kid...
I’ve been enjoying https://www.unslop.news/ after it was shared here.
HN has become unbearably AI slop oriented over the last couple of years. It’s nice to see something else.
[flagged]
[flagged]
[dead]
I _also_ posted to HN and made it to #1[0]; the effect this had on my CPU/network traffic on a 5/EUR month VPS over at Hetzner was in the single digit percentages.
As per the wiki page for the C10k problem[1] where it says "_was_ [emphasis mine] the problem of optimizing computer networking stacks to handle a large number of clients at the same time". This was solved over a decade ago...
Now get off my lawn!
(TBF I think the author acknowledges this)
There is so much spam, abuse, and aggressive scraping that I've had to block:
and a handful of other ASNs on almost all of my properties. It would be one thing if it was simple scraping, but it's often genuine agentic abuse (just spamming for vulnerabilities* or scraping millions of pages with very little valuable or dynamic content). These clouds must get the abuse happening under their own roof under control.I banned Alibaba's Cloud two years ago and it still hits one of my domains 1 million times per day, despite every route 4xx-ing during that time.
Even Apple has aggressively ramped up its scraping in the past few months, but thankfully they do respect robots.txt.
It's frustrating because some of my real users route through these clouds via their work VPNs. Also, there are a lot of less-than-reputable AI scrapers using global bot-nets via residential IPs to scrape, making it even harder to detect and ban them without affecting real people.
* like leaked .env routes, brute forcing admin panels, and so on