Hacker News Reader

Comment by pak | Hacker News Reader

Yes, but I believe their intent was to rewrite the other script as it functioned, not for it to be any more effective.

I suppose. I wonder what would be a better way to find their web server. Maybe looking for IPs that run a web server using nginx, but don't respond to the host specified in their rDNS record. Then again, that would lead to way too many hosts.

I doubt they'll set up a PTR record. What they'd do if they're smart is firewall their box so it only accepts port 80 requests from Cloudflare's systems. Anything else can be discarded, e.g.:

  iptables -A INPUT DROP
  iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  iptables -A INPUT -p tcp --dport 80 -s w.x.y.z/xx -j ACCEPT

Probably. There are a lot of hosting/VPS companies out there that have instant provisioning and don't ask too many questions. I imagine it would be pretty hard to find them this way unless they do something stupid.

Reply on news.ycombinator.com