{"id":123874,"date":"2025-04-30T09:05:06","date_gmt":"2025-04-30T07:05:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ispolzovanie-zip-bomby-dlya-borby-s-vredonosnymi-web-botami"},"modified":"2025-04-30T09:05:06","modified_gmt":"2025-04-30T07:05:06","slug":"ispolzovanie-zip-bomby-dlya-borby-s-vredonosnymi-web-botami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/ispolzovanie-zip-bomby-dlya-borby-s-vredonosnymi-web-botami","title":{"rendered":"Using a Zip Bomb to Combat Malicious Web Bots","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Recently, the activity of web bots indexing traffic has significantly increased. In addition to properly functioning bots, there has been a rise in 'ferocious' bots that ignore robots.txt indexing rules, operate from tens of thousands of different IPs, masquerade as legitimate users, and do not adhere to a reasonable request rate policy. These bots create a massive parasitic load on servers, disrupt the normal functioning of systems, and waste administrators' time. The activity of such bots is perceived by many as malicious actions. <\/p>\n
As a measure to slow down the operation of such bots, as well as bots scanning unpatched vulnerabilities in typical web applications, one of the administrators proposed the 'zip bomb' method. The essence of the method is that, in response to a page request, the web bot is presented with content that is effectively compressed using the 'deflate' method, the size of which, when unpacked, exceeds the size of the data transmitted over the network many times over. For example, when using the 'deflate' method, content from \/dev\/zero, packed into 10 MB, will require 1 GB of disk space upon unpacking. By using the 'brotli' compression method, a level was achieved where transmitting 81 MB results in unpacking 100 TB of data. <\/p>\n
This type of protection can be activated by creating traps that are accessible via invisible links marked with the flag 'rel=\"nofollow\"', excluded from indexing through robots.txt, and triggered at a sufficiently high recursion level for bots attempting to pretend to be ordinary users. In practice, the proposed method is not recommended, as the site may be blacklisted by Google and begin to be flagged as malicious in the Chrome browser with 'Safe Browsing' mode enabled. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"