Blocking Tor and anonymising proxies in AWS WAF: when it makes sense and how to roll it out
After a wave of credential stuffing against our login endpoint arrived mostly through Tor and anonymising proxies, we added IP reputation controls in AWS WAF. When blocking Tor is reasonable and when it is not, which managed rule groups to use, why we started in count mode, and how we handled false positives.