DEV Community

utilvo
utilvo

Posted on Originally published at utilvo.com

How to Stop Rotating-IP Cloud Scrapers (AS132203 & AS45102) on Nginx & Apache 2.4 in <0.08ms — Without Blocking Googlebot

#nginx #apache #security #devops

If you run a Next.js, WordPress, Laravel, or SaaS production server on Nginx or Apache 2.4 / LiteSpeed in 2026, you have likely noticed two simultaneous anomalies:

  1. Google Analytics 4 (GA4) suddenly reports thousands of 100% bounce-rate sessions with 0s engagement time originating from Singapore, Lanzhou, Hong Kong, or Ashburn.
  2. Your Nginx or Apache access.log shows relentless GET / and GET /?_rsc=... requests rotating across thousands of unique IPv4 addresses every hour while spoofing legacy mobile User-Agents (CPU iPhone OS 13_2_3 like Mac OS X) or headless desktop Chrome signatures.

Traditional IP rate-limiting (limit_req_zone, mod_evasive, or basic Fail2Ban jails) fails completely because the scraper cluster rotates across entire /10, /12, and /15 cloud datacenter CIDR allocations (Tencent Cloud AS132203, Alibaba Cloud AS45102, Huawei Cloud AS136907, and BytePlus AS139902), sending only 1–2 requests per IP.

Here is how we engineered Utilvo EdgeShield (v1.1.0) to neutralize both the server-level load (across Nginx, Apache 2.4 httpd.conf, and .htaccess) and the client-side GA4 pollution in sub-millisecond time while guaranteeing 100% SEO Safe-Harbor for Googlebot, Bingbot, Applebot, and DuckDuckBot.

1. Nginx Edge Protection: ngx_http_geo_module Radix Trees (< 0.08ms)

Evaluating hundreds of IP ranges inside linear regular expressions (if ($remote_addr ~* ...)) forces Nginx workers to scan every rule on every HTTP request. Instead, Nginx's native geo module compiles CIDR blocks into an in-memory radix tree at startup (O(1) lookup time).

We pair the geo table with a Safe-Harbor Crawler Map so verified search engine bots are never blocked:

# Generated by Utilvo EdgeShield v1.1.0 (https://utilvo.com/edge-shield)
# Live Self-Updating Threat Feed: https://utilvo.com/api/edge-shield/threats?format=cidr

geo $utilvo_blocked_cidr {
    default 0;
    43.128.0.0/10     1; # AS132203 Tencent Cloud
    101.32.0.0/15     1; # AS132203 Tencent Cloud
    47.74.0.0/15      1; # AS45102  Alibaba Cloud
    47.88.0.0/15      1; # AS45102  Alibaba Cloud
    8.208.0.0/12      1; # AS45102  Alibaba Cloud
    114.119.128.0/18  1; # AS136907 Huawei Cloud
}

map $http_user_agent $utilvo_safe_search_bot {
    default 0;
    ~*(Googlebot|Google-InspectionTool|AdsBot-Google|bingbot|Applebot|DuckDuckBot) 1;
}
Enter fullscreen mode Exit fullscreen mode

2. Apache 2.4 (mod_authz_core + mod_remoteip) & .htaccess (mod_rewrite)

For Apache HTTP Server 2.4, LiteSpeed, and cPanel environments, linear Deny from directives are deprecated and slow. Instead, Apache 2.4's mod_authz_core (Require not ip) evaluates CIDR masks directly in C, while mod_setenvif provides an explicit SEO Safe-Harbor bypass (Require env utilvo_seo_safe) inside a <RequireAny> block:

# Direct Raw Config: https://utilvo.com/edge-shield/apache-bot-shield.conf
<IfModule mod_setenvif.c>
    SetEnvIfNoCase User-Agent "(Googlebot|Google-InspectionTool|AdsBot-Google|bingbot|Applebot|DuckDuckBot|Slurp|YandexBot)" utilvo_seo_safe=1
    SetEnvIfNoCase User-Agent "(HeadlessChrome|PhantomJS|Puppeteer|Playwright|Bytespider|PetalBot|ClaudeBot|GPTBot|CCBot)" utilvo_bad_bot_ua=1
</IfModule>

<IfModule mod_authz_core.c>
    <Location "/">
        <RequireAny>
            # 100% SEO Safe-Harbor: verified search crawlers always pass
            Require env utilvo_seo_safe
            <RequireAll>
                Require all granted
                Require not env utilvo_bad_bot_ua
                # AS132203 (Tencent Cloud), AS45102 (Alibaba Cloud), AS136907 (Huawei Cloud)
                Require not ip 43.128.0.0/10 101.32.0.0/15 119.28.0.0/16 124.156.0.0/16
                Require not ip 43.119.0.0/16 47.74.0.0/15 47.82.0.0/16 47.88.0.0/15 8.208.0.0/12
                Require not ip 149.232.0.0/16 159.138.0.0/16 114.119.0.0/16 46.250.0.0/16
            </RequireAll>
        </RequireAny>
    </Location>
</IfModule>
Enter fullscreen mode Exit fullscreen mode

Shared Hosting / cPanel .htaccess (mod_rewrite) Alternative

When root httpd.conf access is unavailable on shared hosting or LiteSpeed, .htaccess can enforce the exact same SEO Safe-Harbor and subnet blocklist:

<IfModule mod_rewrite.c>
    RewriteEngine On
    # 1. SEO Safe-Harbor Bypass (Never block Googlebot / Bingbot / Applebot)
    RewriteCond %{HTTP_USER_AGENT} !(Googlebot|Google-InspectionTool|AdsBot-Google|bingbot|Applebot|DuckDuckBot) [NC]
    # 2. Block Headless Scrapers & High-Risk Cloud Subnets (AS132203 / AS45102)
    RewriteCond %{HTTP_USER_AGENT} (HeadlessChrome|PhantomJS|Puppeteer|Playwright|Bytespider|PetalBot) [NC,OR]
    RewriteCond %{REMOTE_ADDR} ^(43\.(1[2-8][0-9]|19[0-1])\.|101\.3[2-3]\.|47\.(7[4-5]|8[289])\.|114\.119\.)
    RewriteRule ^.*$ - [F,L]
</IfModule>
Enter fullscreen mode Exit fullscreen mode

1-Line Automated Installer (Auto-Detects Both Nginx & Apache 2.4) 

# Auto-detects Nginx or Apache 2.4 (or pass --server=apache / --server=nginx)
curl -sSL https://utilvo.com/edge-shield/install.sh | sudo bash
Enter fullscreen mode Exit fullscreen mode

3. Stopping Headless Chromium (SwiftShader / llvmpipe) from Firing GA4 gtag.js

When a headless Chromium instance bypasses CDN edges via residential or unflagged proxies, it still exposes its software WebGL renderer (Google SwiftShader or llvmpipe) and zero-dimension viewport metrics.

Utilvo EdgeShield includes a < 1KB client-side guard that inspects the WebGL debug renderer before gtag('config', 'G-XXXXXX') can fire—completely eliminating synthetic GA4 traffic spikes without affecting real visitors.

4. Interactive Rule Customizer & Live Threat Feed

You can customize your Nginx, Apache 2.4 (httpd.conf), Apache (.htaccess), and Cloudflare WAF rules or scan your raw access.log directly in the browser:

Top comments (0)