I have an API that is somewhat popular (10,000+ requests/day). After 10 requests per day from an IP address I return a message telling the user they need to cough of some cash if they want to use the service more.
This morning, I found that my web service was running terribly slow. I checked out the DB and I was getting absolutely spammed with requests from IP addresses originating in China. They would use an IP address 10 times and then increment the last octet. Sad times.
I’d like to limit or completely cut off requests from China, for the sake of keeping the system alive. What’s the best way to do this? Geolookup each request and ban by country code in PHP? This seems like an inefficient way. There’s nothing I can do at the htaccess level, is there?
Just block the entire china IP range:
in .htaccess