Originally published on proxymint.
How Anubis proof of work runs: the SHA-256 puzzle, the week-long cookie bound to your IP, weights by country and ASN, its limits, and where proxies fit.
TL;DR
- Anubis makes the browser pay a small hash cost before a page loads. It must find a nonce whose SHA-256 hash with a random server string starts with a set number of zeros; the server checks the answer with one hash.
- One pass lasts a week from one IP. The signed cookie expires after seven days by default and is bound to the client address and to the policy rule that issued it.
- Weights pick the difficulty. A browser User-Agent, a weighted country or a weighted cloud network each add points, and thresholds turn the total into allow, meta refresh or a proof of work of difficulty 2, 4 or 6.
- Proof of work prices access and does not prove identity. Native solvers and real browsers pass it, so the project now adds ASN weights, memory-hard puzzles and headless detection.
Key takeaways
- Expect a new challenge after any IP change. JWT_RESTRICTION_HEADER defaults to X-Real-IP, so a rotating exit, a VPN or a carrier reassigning an address resets the pass.
- Read the body, not the status code. Anubis returns HTTP 200 for both challenge and deny pages by default, so a crawler that logs only status codes misreads both.
- Test before you weigh. Site owners should load the site from carrier and residential networks in the affected countries before shipping a GeoIP or ASN weight.
- Ask for an allow rule instead of pushing. The policy file can allow a named crawler from a fixed address range, which is the route search engines use.
Read the full guide on proxymint, with the commands, tables and sources.
Top comments (0)