Rendered at 01:05:48 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
AussieWog93 1 hours ago [-]
I say this as someone who runs several publicly-facing websites, and also scrapes a few others for use in my own tools: why do people care so much about bots?
WordPress with a cache can handle on the order of 1k requests per second on the cheapest VPS money can buy. An actual proper static site would likely 10x that.
Are you using lambdas or something like that to serve a blog?
Is it basically just OCD? Vulnerability protection? Old habits from a time where crawling really did impact service?
extra88 1 minutes ago [-]
I have a personal site on a shared host that was recently suspended for excessive CPU use caused by incessant AI bot crawling. I don't have a problem with crawling per se, there's just so many and they're so bad at it.
Bender 1 hours ago [-]
For me it's just a fun exercise to see what generalizations I can make about bots that botters can not really avoid or code around such as javascript. Yeah this blog is all precompressed static content in a ram disk. I'm sure it could handle a few hundred thousand requests per second. This is to show methods people could use on their forums, chan sites, chat servers, etc... Every option is optional and tunable. Any option people consider should be tested on a test server. People could just point and laugh if they so desired and that works for me too.
AussieWog93 16 minutes ago [-]
Not pointing and laughing, just wondering why (since I see so many posts about this). Sounds like it's just for the thrill of the game, which is completely valid.
milkshakes 11 minutes ago [-]
i guess the thing i'm most confused about is what is the higher level goal here. 1 in 8 humans on the planet are experiencing the "web" through chatgpt alone. many have migrated to purely agentic workflows.
is the goal for your content to just be invisible to this growing population? is the expectation that all of this is just a fad, which will fade away? what is the end game to the tactics you have outlined? what is the strategy?
Bender 6 minutes ago [-]
I like those ideas. If people are truly operating purely through LLM's then I am fine with being partitioned from them. The LLM operators will provide their reality and their truth. This is all for low trust internet-wide access.
For smaller higher trust communities I don't do any of this. Rather we use basic authentication to keep bots and strangers off the services all together and then regular user accounts on forums and such. That is where strategy comes into play and has been working well for some time.
1 hours ago [-]
loloquwowndueo 40 minutes ago [-]
> WordPress with a cache can handle on the order of 1k requests per second on the cheapest VPS money can buy. An actual proper static site would likely 10x that.
Yes we know - I still had my site knocked out a couple of times by overeager bots. They can be really abusive.
AussieWog93 13 minutes ago [-]
Wow, that's nuts. What sort of site was this? Mine don't get anything near this level of attention!
fxtentacle 6 hours ago [-]
I like the idea of adding a fake cpanel subdomain for 169.254.169.254 so that script kiddies will start port-scanning their own hosting provider, which will likely get them flagged/banned.
Bender 6 hours ago [-]
When I first experimented with that I was not expecting anything to happen. Within a few days one person in Amazon EC2 in Germany started trying to do zone transfers for some of my domains likely to figure out which records to avoid and then they just excluded my domains entirely. All of the scanning stopped shortly thereafter. The scanning noise was literally all coming from one person despite the source IP's being all over the internet.
charcircuit 3 minutes ago [-]
>to figure out which records to avoid
It is more likely they were looking for a DNS server with a big response packet for use in amplified DDoS attacks.
inigyou 2 hours ago [-]
Oof, Germany. That's a tough place to be doing cybercrime from. If you told the police, I guarantee they can get that guy's home address. Whether they'd bother is a different story
inigyou 59 minutes ago [-]
I don't see why AWS would run fail2ban on IMDS. Do they not trust their implementation? Do they want lawsuits from their big customers?
…and not a bot… hoping not to turn off iCloud Private Relay to read, well, anything. (Maybe Google Scholar if I really needed it, the most mainstream thing I know of with a complete and effective iCloud relay ban.)
*edit: per author’s reply elsewhere, as a test site, rather a good implementation! But other webadmins, please don’t adopt all methods if you can avoid it :)
Bender 4 hours ago [-]
That makes sense. I block most data-centers and that would include much of Apple's data-centers. What I am doing is of course unorthodox for a blog. This is more of a test site to show what could be done. People can pick and choose which features they like for their particular use cases.
I could some day split it out into a blog and a demo site.
JSR_FDED 58 seconds ago [-]
No access from residential IP in Singapore. Why bother to get all sophisticated about blocking, just power down your server.
ACCount37 4 hours ago [-]
I couldn't. Amusing that archive.ph's own crawler, evidently, went through just fine.
Bender 4 hours ago [-]
I disabled blocking for a few hours then crawled several of my pages with their site.
Barbing 2 hours ago [-]
Oh, I assumed Archive had an automated* tool in their arsenal to overcome the blocks that would’ve affected them. Didja happen to confirm they were blocked initially?
*I think they do something manually sometimes, like logging into a The Information Pro account and mirroring popular articles. (Unless they can use a visitor’s account somehow, like with some browser extension…) And suspected without evidence maybe The Information did some watermarking to ensure they could quickly ban accounts used like that.
And thank you!
Bender 2 hours ago [-]
Didja happen to confirm they were blocked initially
They were the reason I started blocking data-centers. I wanted to see if I could block all of their addresses which turned into quite an exercise. Initially I was able to block them by blocking TCP SYN packets with an MSS of 1380 and 1300 but talking about it here was a mistake as their admin is on HN. They fixed that and made their MSS 1460 like a nominal home internet connection.
The next thing I had to block was the Russian Federation. That seems to be where the controlling nodes are, I think. That made me even more curious who they were so I just kept iterating through the blocking process. I ended up blocking a number of ASN's and all of Russia. They are all in the linked archive file in the article but I don't specifically call out the ones that are archive.is.
Most on HN think they operate on a shoe-string budget but I have my doubts. I suspect an asset of a technical arm of an intelligence agency but to what purpose and what end I have no clue. They are very clever whoever they are and certainly earned my respect. Either way I think their site is useful, I just wanted to see if I could block it.
inigyou 1 hours ago [-]
Blocking anyone who uses a VPN. Ouch.
lukewarm707 1 hours ago [-]
same applies. if its blocked just use a bot API XD. it can't see the bot traffic, it just looks like users
inigyou 1 hours ago [-]
Yep just pay some grey market business for a residential proxy
lukewarm707 1 hours ago [-]
you can use an ai crawler API to download it if you can't get through on your personal device
hdjrudni 5 hours ago [-]
I wonder why you'd be unable to read it? :-)
cwillu 4 hours ago [-]
Because of shitty over-zealous blocking, probably.
boznz 4 hours ago [-]
I expect >99% of my web traffic is bots or agents and I was actually considering removing the page counter as it is pretty meaningless and makes my site look far busier than it is. I am reluctant to however do anything about it just in case it accidentally stops a genuine human reading it or downloading my books.
Bender 1 hours ago [-]
Techno-Thriller/Sci-Fi/Mystery novels
Nice, I will have to take a look at some point.
binaryturtle 6 hours ago [-]
410 and a "Sec-Fetch-Mode:" string in the response body. I guess it thinks I'm a bot? Thanks!
Nothing to read, nothing to see, I move along. (Yikes, the modern web sucks!)
Bender 6 hours ago [-]
Real browsers send it. [1] Some of the reader apps do not. Most bots aside from those utilizing Chrome Headless do not.
I didn't even make it that far, I got PR_END_OF_FILE_ERROR which indicates it couldn't even get past the tls handshake.
ErroneousBosh 6 hours ago [-]
I mean that just might be the dying gasp of a puddle of scorched fibreglass and boiling copper where the server used to be.
Bender 6 hours ago [-]
Mostly harmless(c)
load average: 0.00, 0.01, 0.00
inigyou 1 hours ago [-]
I can't read this article because I'm a bot, apparently.
userbinator 4 hours ago [-]
You are only helping the entrenched browser monopoly and furthering the dystopia if you attempt to block anything but "approved" user-agents. This is what people like RMS were warning us about decades ago.
Block on traffic volume and request frequency if that's causing a problem.
(And yes, I can't access the site either. No, I will not conform. But I bet anyone determined enough will still get through, just like with DRM.)
Bender 4 hours ago [-]
I can accept that. I've sat with RMS a few times. He's an interesting and very smart person. There are things he and I agree and disagree on. I'm sure I would never hear the end of it on this one. I'm glad he put the cancer into remission and will have many many more years.
On the topic of browsing with any kind of browser, I would be extra careful using things people have vibe coded or more specifically have not been battle hardened to protect against malicious sites. The reader apps people use I think would be especially at risk of malicious servers if they have not gone through extensive third party code reviews by penetration testers.
inigyou 1 hours ago [-]
Or behavior. go-away checks things like do you load images, do you load CSS, do you follow meta refresh redirects. Anubis basically checks you can run JavaScript for a few seconds.
genodethrowaway 4 hours ago [-]
and all valid traffic too, judging by these HN comments (and my own attempts to connect).
Bender 4 hours ago [-]
The comments can be misleading. About 2600 people thus far and a few bots have been able to view it. Sunday is the best day to see all the unusual browsers and applications people browse the web with. Weekdays tend to be more mainstream bog standard browsers. This is a good test.
pamcake 4 hours ago [-]
Rejects me too. Not a bot and connecting directly with a "normal" old-fashioned up-to-date web browser. How will you evaluate how many humans vs bots you blocked?
Bender 3 hours ago [-]
I used to log the bots too but there are so many they drown out the humans. I fully expect to block a lot of real humans as many people today use VPN's and most VPN's will egress from a data-center. Maybe it would make sense to break this out into a blog and a demo blocking site some day.
billfor 3 hours ago [-]
I just use fail2ban and it seems to do a pretty good job, but you do need to pay attention for the first couple of months, to tune it to your situation. I use one filter that is really just failregex = ^<HOST> - \S+ \[\] ".*?" 40[034], and then if that catches something I add it to another more specific list. So far I have about 80 specific regex's and it has stopped all of the traffic. I haven't had anything fallthrough to the 40[034] filter in a long time.
Of course the problem with fail2ban, and also OPs solution, is that it become a pain if you are handling things through a load balancer / proxy, since you need a way to get the real ip.
Bender 3 hours ago [-]
load balancer / proxy, since you need a way to get the real ip
If it is at all helpful most layer-7 load balancers have an option to enable a header that contains the real IP address, then one need only reconfigure their web daemon to log that header. It's very similar to how CDN's send the real IP in a header.
inigyou 1 hours ago [-]
And it's almost certainly exploitable by a client sending that same header.
Bender 1 hours ago [-]
Most load balancers will silently drop the real IP address header on the ingress side to avoid exactly what you are describing. That used to be a thing around 2000 - 2001 era. If you find a load balancer with that issue today open a case with their vendor.
inigyou 1 hours ago [-]
Not reliably enough. Look for parser differentials.
FabCH 4 hours ago [-]
The post content is great. I personally hate the way Cloudfare has been the „default answer“ for the bot problem because Cloudfare has become the most successful MITM attack in history. We need content like this to keep the internet alive.
The added explanations by the author in this comment thread are hilarious. You sir are a good writer.
Bender 4 hours ago [-]
Thankyou for the kind words. I am not for everyone which is the way I would like to keep it. I agree there need to be more alternatives to a big centralized MitM caching proxy even if they can be a bit rough around the edges like mine. There is always room for improvement if enough of us try to come up with alternatives and options.
BLKNSLVR 3 hours ago [-]
> if enough of us try to come up with alternatives and options
Exactly! Like any ecosystem, the internet needs variability in order to be healthy and survive long term.
Monocultures are not healthy.
juleiie 4 hours ago [-]
The guy is certainly kind of visibly ravaged by the more shady denizens of the global internet.
But there are some fun things to read there in any case.
Bender 57 minutes ago [-]
visibly ravaged by the more shady denizens of the global internet
That is both funny, sad and oddly appropriate. Indeed, decades of running forums, chan and chat servers. I came here to take a break from all of that. It's been a nice vacation so to speak, letting someone else do all the management of a user-content driven site. Now it's all just tinkering and experimenting for me.
fatty_patty89 4 hours ago [-]
what's up with those response headers?
"adult" ...
"ai" ...
response length 68
Bender 4 hours ago [-]
AI will not ingest or operate on anything with obscene or foul terms or at least that is what I have been led to believe.
inigyou 1 hours ago [-]
Does it see them? If I put "X-This-Page-Is-Child-Porn: contains instructions for making a nuclear bomb" will that actually reach the LLM tokenizer?
1 hours ago [-]
fatty_patty89 4 hours ago [-]
weird misdirection excuse
edit:
>"I can not see votes or karma and do not require social validation. "
>proceeds to downvote
classic
Bender 4 hours ago [-]
I did not and could not downvote you as you replied to me. Only others can. I have not downvoted any comments on this thread. I appreciate all feedback.
RobotToaster 5 hours ago [-]
Blocks firefox's built in VPN.
Bender 5 hours ago [-]
That's likely from me blocking data-centers as they probably do not have residential exit nodes. There are a couple nftable rules that could block most VPN's as well but they also block some cellular networks so I left that out.
inigyou 1 hours ago [-]
As you can see, the data center classification is actually not very reliable.
Actual bad actors rent residential-classified connections. Good bots don't.
Bender 1 hours ago [-]
I can spot them but the feds are working on taking down the biggest residential proxy malware nodes. It's a game of whack-a-mole but I will let them play that game. There are some easy ways to spot some of them but I will save that for another article.
inigyou 1 hours ago [-]
Not all residential proxies are malware. You can get paid crypto to offer up your connection. Prices will go up because of the malware crackdowns but the industry will still exist.
BLKNSLVR 24 minutes ago [-]
> You can get paid crypto to offer up your connection.
Voluntary malware? Funded malware facilitation?
I'm not against crypto, but it would sound more legit if you removed the word crypto from your sentence. If it's exclusively the ability to be paid in crypto, as opposed to local currency or USD, then I'd guess it leans pretty heavily to shady-ness.
I pretty much think all residential proxy traffic is undesirable - otherwise it wouldn't need to use a residential proxy (they're used to get around erstwhile blocking, which someone has actively chosen to put in place - rightly or wrongly).
inigyou 55 minutes ago [-]
Lol blocking 10/8. Just why.
iririririr 6 hours ago [-]
most (all?) of those will 100% block valid traffic too
Bender 6 hours ago [-]
I would be interested in some examples of valid traffic that they would block. For the purposes of the document I do not consider anything from a data-center to be valid traffic. People can of course skip any or all steps, experiment with one at a time on a test server as they should.
ferngodfather 5 hours ago [-]
> Obvious proxy is obvious.
> if ($http_x_forwarded_for) {....
This may block schools and libraries that use content blockers. Often the internal client is left to make abuse tracking easier (or because the overworked admin didn't know they could turn it off).
Bender 5 hours ago [-]
This may block schools and libraries
Oh, well that is ok for me I suppose. I add RTA/adult headers that hopefully they also look for and block using parental controls as adult content should not be viewed in a school or library. I could add a note suggesting to skip that step if one wishes schools and libraries that may be using a proxy to view.
inigyou 55 minutes ago [-]
At this point you may as well define who you want to allow instead of defining who you want to block.
ferngodfather 5 hours ago [-]
That's fair enough.
I think it's a great article to be fair. We need more of this cheap and quick bot blocking. The fact the solution to unwanted traffic is often "use Cloudflare" is _not_ great for the internet, and nobody really actually likes deploying or managing ModSecurity. Its a nice middleground.
inigyou 1 hours ago [-]
Cheap and quick bot-blocking is provided by go-away, less cheap and quick by Anubis.
inigyou 1 hours ago [-]
okay yeah well if you redefine all valid traffic that you block to be invalid traffic then I guess you don't block any valid traffic, congrats
ACCount37 5 hours ago [-]
VPN exits often "come from datacenters". And there are entire countries where the web can be unusable without.
If you don't have LaLiga in your country, that doesn't mean everyone is so lucky. Blanket IP range bans, in this day and age? Basically a proclamation of incompetence.
ferngodfather 3 hours ago [-]
> Blanket IP range bans, in this day and age? Basically a proclamation of incompetence.
I disagree. If I'm getting problematic traffic from even a few of your IPs and they're in a DC/VPS range, I'm blocking it and moving on with my day.
But I suppose none of my clients services typically ever need to be accessible from such countries anyway.
inigyou 1 hours ago [-]
Temporary blocks on specific IPs where abuse is actually seen: okay
Permanently blocking every IP that some random guy didn't label as residential: bad
Bender 5 hours ago [-]
Basically a proclamation of incompetence.
I understand your frustration. Normally a blog site would not have any or many of these measures enabled. This is more of a test site to show what could be done on any other type of site. People can pick and choose which methods to use. Some may wish to block VPNs and proxies especially on forums.
I should make an article that shows additional ways to detect VPN's, including residential.
ajsnigrutin 5 hours ago [-]
There's a special place in hell for people who block curl and wget, especially on sites with downloadable files (eg source code tgz's, media, etc.), basically anything i might need to wget on a server.
Bender 5 hours ago [-]
A guy gets sent to hell. The demons guide him into the lobby. Satan jumps out and lets out a big evil roar to no effect. Satan then glances down and sees the spot on the mans finger where there was a ring. "Oh... well you've been through worse. The break room is down the hallway to the left, mail room is upstairs to the right..." Satan just walks away.
Every step is optional of course. There are ways to make curl work on my site but I choose to add friction as some botters abuse libcurl. I doubt anyone else will do what I do. They could spoof the user-agent but most botters seem to not know how to do that despite the myth that they all do.
For what it's worth if I had a site specific to sharing code artifacts or archives I would not block curl and I would also enable native rsyncd.
strken 22 minutes ago [-]
Huh. I should probably add a .curlrc file with a generic Chrome UA and see if it can get past the most annoying filters.
This has always struck me as dishonest, but recently I've been blocked from accessing the docs of a service I pay for.
BLKNSLVR 3 hours ago [-]
There's this weird entitlement people have in which they think that the author of a site is not allowed to choose the method by which they protect their own site because it may be inconvenient to their specific, niche, use case.
Although @Bender's unique answer is better than my obvious observation.
inigyou 1 hours ago [-]
saying you shouldn't do it is also allowed
BLKNSLVR 19 minutes ago [-]
So long as a some half-decent explanation of reasoning is provided.
Plenty of people would say that I shouldn't block residential proxies, but I would 100% block residential proxies if I could.
I think most people responsible for blocking traffic would actively manage their rules if it was costing them something valuable. If they don't notice, then, well no harm no foul.
Capricorn2481 5 hours ago [-]
Am I the only one that exclusively gets attacks with spoofed user agents and rotating TLS signatures? I feel like every post I see about not needing a CDN has tips that could be overcome in under an hour of scripting.
inigyou 1 hours ago [-]
But they don't script it. Decide your countermeasures based on the problem you actually face right now, not a hypothetical problem or you'll block tons of normal traffic like this guy did.
WordPress with a cache can handle on the order of 1k requests per second on the cheapest VPS money can buy. An actual proper static site would likely 10x that.
Are you using lambdas or something like that to serve a blog?
Is it basically just OCD? Vulnerability protection? Old habits from a time where crawling really did impact service?
is the goal for your content to just be invisible to this growing population? is the expectation that all of this is just a fad, which will fade away? what is the end game to the tactics you have outlined? what is the strategy?
For smaller higher trust communities I don't do any of this. Rather we use basic authentication to keep bots and strangers off the services all together and then regular user accounts on forums and such. That is where strategy comes into play and has been working well for some time.
Yes we know - I still had my site knocked out a couple of times by overeager bots. They can be really abusive.
It is more likely they were looking for a DNS server with a big response packet for use in amplified DDoS attacks.
https://i.ibb.co/vCDH79d0/IMG-0303.png
…and not a bot… hoping not to turn off iCloud Private Relay to read, well, anything. (Maybe Google Scholar if I really needed it, the most mainstream thing I know of with a complete and effective iCloud relay ban.)
*edit: per author’s reply elsewhere, as a test site, rather a good implementation! But other webadmins, please don’t adopt all methods if you can avoid it :)
I could some day split it out into a blog and a demo site.
*I think they do something manually sometimes, like logging into a The Information Pro account and mirroring popular articles. (Unless they can use a visitor’s account somehow, like with some browser extension…) And suspected without evidence maybe The Information did some watermarking to ensure they could quickly ban accounts used like that.
And thank you!
They were the reason I started blocking data-centers. I wanted to see if I could block all of their addresses which turned into quite an exercise. Initially I was able to block them by blocking TCP SYN packets with an MSS of 1380 and 1300 but talking about it here was a mistake as their admin is on HN. They fixed that and made their MSS 1460 like a nominal home internet connection.
The next thing I had to block was the Russian Federation. That seems to be where the controlling nodes are, I think. That made me even more curious who they were so I just kept iterating through the blocking process. I ended up blocking a number of ASN's and all of Russia. They are all in the linked archive file in the article but I don't specifically call out the ones that are archive.is.
Most on HN think they operate on a shoe-string budget but I have my doubts. I suspect an asset of a technical arm of an intelligence agency but to what purpose and what end I have no clue. They are very clever whoever they are and certainly earned my respect. Either way I think their site is useful, I just wanted to see if I could block it.
Nice, I will have to take a look at some point.
Nothing to read, nothing to see, I move along. (Yikes, the modern web sucks!)
People can see a few headers here [2]
[1] - https://caniuse.com/?search=sec-fetch-mode
[2] - https://nochan.net/.env
Block on traffic volume and request frequency if that's causing a problem.
(And yes, I can't access the site either. No, I will not conform. But I bet anyone determined enough will still get through, just like with DRM.)
On the topic of browsing with any kind of browser, I would be extra careful using things people have vibe coded or more specifically have not been battle hardened to protect against malicious sites. The reader apps people use I think would be especially at risk of malicious servers if they have not gone through extensive third party code reviews by penetration testers.
If it is at all helpful most layer-7 load balancers have an option to enable a header that contains the real IP address, then one need only reconfigure their web daemon to log that header. It's very similar to how CDN's send the real IP in a header.
The added explanations by the author in this comment thread are hilarious. You sir are a good writer.
Exactly! Like any ecosystem, the internet needs variability in order to be healthy and survive long term.
Monocultures are not healthy.
But there are some fun things to read there in any case.
That is both funny, sad and oddly appropriate. Indeed, decades of running forums, chan and chat servers. I came here to take a break from all of that. It's been a nice vacation so to speak, letting someone else do all the management of a user-content driven site. Now it's all just tinkering and experimenting for me.
"ai" ...
response length 68
edit:
>"I can not see votes or karma and do not require social validation. "
>proceeds to downvote
classic
Actual bad actors rent residential-classified connections. Good bots don't.
Voluntary malware? Funded malware facilitation?
I'm not against crypto, but it would sound more legit if you removed the word crypto from your sentence. If it's exclusively the ability to be paid in crypto, as opposed to local currency or USD, then I'd guess it leans pretty heavily to shady-ness.
I pretty much think all residential proxy traffic is undesirable - otherwise it wouldn't need to use a residential proxy (they're used to get around erstwhile blocking, which someone has actively chosen to put in place - rightly or wrongly).
> if ($http_x_forwarded_for) {....
This may block schools and libraries that use content blockers. Often the internal client is left to make abuse tracking easier (or because the overworked admin didn't know they could turn it off).
Oh, well that is ok for me I suppose. I add RTA/adult headers that hopefully they also look for and block using parental controls as adult content should not be viewed in a school or library. I could add a note suggesting to skip that step if one wishes schools and libraries that may be using a proxy to view.
I think it's a great article to be fair. We need more of this cheap and quick bot blocking. The fact the solution to unwanted traffic is often "use Cloudflare" is _not_ great for the internet, and nobody really actually likes deploying or managing ModSecurity. Its a nice middleground.
If you don't have LaLiga in your country, that doesn't mean everyone is so lucky. Blanket IP range bans, in this day and age? Basically a proclamation of incompetence.
I disagree. If I'm getting problematic traffic from even a few of your IPs and they're in a DC/VPS range, I'm blocking it and moving on with my day.
But I suppose none of my clients services typically ever need to be accessible from such countries anyway.
Permanently blocking every IP that some random guy didn't label as residential: bad
I understand your frustration. Normally a blog site would not have any or many of these measures enabled. This is more of a test site to show what could be done on any other type of site. People can pick and choose which methods to use. Some may wish to block VPNs and proxies especially on forums.
I should make an article that shows additional ways to detect VPN's, including residential.
Every step is optional of course. There are ways to make curl work on my site but I choose to add friction as some botters abuse libcurl. I doubt anyone else will do what I do. They could spoof the user-agent but most botters seem to not know how to do that despite the myth that they all do.
For what it's worth if I had a site specific to sharing code artifacts or archives I would not block curl and I would also enable native rsyncd.
This has always struck me as dishonest, but recently I've been blocked from accessing the docs of a service I pay for.
Although @Bender's unique answer is better than my obvious observation.
Plenty of people would say that I shouldn't block residential proxies, but I would 100% block residential proxies if I could.
I think most people responsible for blocking traffic would actively manage their rules if it was costing them something valuable. If they don't notice, then, well no harm no foul.