This website has been under fairly constant password guessing attacks for days, with the majority of traffic originating from Digital Ocean cloud-hosted assets.
Did I mention that anybody could simply sign up for an account if they wanted one?
There are a couple of things to think about here:
- Providers that allow a user to do just about anything end up losing reputation. If you’re clients are up to no good, eventually your entire service will be blocked.
- These paths are also the way your clients will reach you. These cheap nodes can be Tor, VPN, and other proxy endpoints that conceal the user’s origin and provide some security where they stand.
So, when you vouch for someone and give them free reign with your technologies, are you setting the stage for problems with people who will take advantage? How will that affect your other users if your service loses reputation? And where do you draw the line in protecting them?
I don’t know that there are any easy solutions. I’m happy to say that the constant barrage had no affect on the current servers, but I’m a bit sad to say that I added every Digital Ocean CIDR range I could find to the firewall’s blacklist — it was just too tedious sifting through their relentless noise.
We’ll see how it goes as things develop.