# anubis
# jerrico
server:
bind_token_to_ip: true
proof_of_work:
enabled: true
difficulty: 10
strict_ip_matching: true
rules:
# 1. Target the specific signature or paths they are abusing
- name: "cunt-who-refuses-to-fuck-off"
user_agent_regex: "(?i:python|requests|curl|wget|scrapy|axios|aiohttp|bot|crawler)"
action: CHALLENGE
challenge:
algorithm: "slow" # definitely do this
difficulty: 20 # Absurdly high difficulty to lock up their scraping threads
# 2. Catch-all aggressive rule for anything not explicitly a known browser
- name: "default-guard"
action: CHALLENGE
challenge:
algorithm: "slow"
difficulty: 14
# 3. Trap path for automated scanners/scrapers looking for hidden endpoints
- name: "honey-pot-trap"
path: "/wp-login.php" # Or whatever path they are brute-forcing/scraping
action: DENY # Silently returns an error message that scrapers mistake for success
Create an Anubis Filter (/etc/fail2ban/filter.d/anubis-scraper.conf):
[Definition]
# Adjust regex to match whatever log format Anubis uses for failed challenges/blocks
failregex = ^.*client_ip=<HOST>.*action=DENY.*$
^.*ip=<HOST>.*challenge_failed.*$
ignoreregex =
Create a Jail (/etc/fail2ban/jail.local):
[anubis-scraper]
enabled = true
port = http,https
logpath = /var/log/anubis/anubis.log # Point to your Anubis log path
filter = anubis-scraper
maxretry = 3 # Ban after 3 failed or abusive hits
bantime = 86400 # Ban for 24 hours
findtime = 60 # Within a 1-minute window
Some configs to get started with
