This page shows the reputation score this site computes for your current IP address, and how that score was reached. It doubles as the documentation for the site’s anti-abuse mechanism: requesting an @haotianblog.com mailbox runs the same scoring, and a higher score means a harder proof-of-work puzzle.
A verification run is required before the lookup. Without that gate this page would be a free IP reputation API: anyone could point a proxy pool at it and enumerate which of their addresses this site rates as clean. Making each lookup cost a second of CPU does not deter one curious reader, and does deter that.
What this score is not
It calls no external reputation API, uses no third-party blocklist, and applies no country weighting. Every signal comes from what this site can observe by itself.
Country is deliberately excluded: it correlates far more strongly with where readers live than with abuse, and this site has readers in two languages across many regions. Charging by region would reliably penalise a group of ordinary readers without buying corresponding protection.
Also, the score sets the price, never the verdict. No score is ever refused outright — a high score only means a harder puzzle. That is intentional: local signals inevitably misjudge, and the cost of a misjudgement should be a few extra seconds, not a blocked request.
The five signals
| Signal | Points | Why |
|---|---|---|
| Reverse DNS points to hosting or cloud | +30 | A home connection almost never resolves to names like amazonaws or digitalocean; automation almost always runs on one |
| No reverse DNS record | +5 | Most residential ISPs publish a PTR record, but absence is far too common to weigh heavily |
| Recent failed verifications | +10 each, capped at 30 | Repeated failure usually means probing the rules rather than ordinary use |
| Repeated solves in a short window | +8 each beyond 2, capped at 25 | Solving a few is normal; solving a dozen within an hour is farming |
| Account age | +15 under a day, +8 under a week | A new account carries none of the history that makes an established one costly to burn |
| Missing or automation-shaped User-Agent | +20 | An unmasked curl or python-requests string says the caller was not trying to look otherwise |
The score caps at 100 and maps onto a 17-21 bit difficulty band. 17 bits is roughly 131k expected hashes (about 0.4s in a browser); 21 bits is about 2.1M (roughly 6s). Each additional bit doubles the work.
Privacy boundary
Raw addresses are never stored. Counters are keyed by an HMAC of the address, salted with a site key, so even with the database in hand the stored values cannot be walked back into an address list. Reverse DNS results are cached for a day under the same hashed key.
The address shown on the page is your own — you already know it, so displaying it discloses nothing new, but it does let you check which address this site actually sees, which is useful behind a proxy.
Why proof of work rather than a visual captcha
A visual captcha outsources the decision to a third party, adds a blocking script to the page, and is solved in bulk by commercial farms for fractions of a cent. Proof of work does not try to distinguish a human from a machine — it makes each attempt cost real CPU time. One request costs a reader a second they will not notice; ten thousand cost an abuser hours of compute per machine.
Its limits should be equally clear: proof of work does not stop a patient single attacker, it only changes the economics. That is why the mailbox flow does not rely on it alone — it also requires a signed-in account, a verified email address, and permits one mailbox per account. This is one layer of defence in depth, not the only door.
Ways it can fail
- No Web Worker or TextEncoder support: the verification button stays in the failed state. Nothing here needs recent browser features, but a very old browser may still fall short.
- Challenge expired: puzzles are valid for ten minutes after issue; past that you need to run it again.
- One puzzle, one use: after a successful lookup a fresh verification is needed for the next one. That is replay protection, not a bug.
- Slower on mobile: phone CPUs run at roughly a third to a half of desktop speed, so the high end of the band can take upwards of ten seconds.
Related reading
- High-entropy traffic defence and chaffing: another approach that changes an attacker’s economics rather than trying to block outright.
- AI security threat modelling: turning “who attacks, and at what cost” into a model you can actually check.
- Tools: other browser-side utilities on this site.