Originally published on proxymint.

How Anubis proof of work runs: the SHA-256 puzzle, the week-long cookie bound to your IP, weights by country and ASN, its limits, and where proxies fit.

TL;DR

  • Anubis makes the browser pay a small hash cost before a page loads. It must find a nonce whose SHA-256 hash with a random server string starts with a set number of zeros; the server checks the answer with one hash.
  • One pass lasts a week from one IP. The signed cookie expires after seven days by default and is bound to the client address and to the policy rule that issued it.
  • Weights pick the difficulty. A browser User-Agent, a weighted country or a weighted cloud network each add points, and thresholds turn the total into allow, meta refresh or a proof of work of difficulty 2, 4 or 6.
  • Proof of work prices access and does not prove identity. Native solvers and real browsers pass it, so the project now adds ASN weights, memory-hard puzzles and headless detection.

Key takeaways

  • Expect a new challenge after any IP change. JWT_RESTRICTION_HEADER defaults to X-Real-IP, so a rotating exit, a VPN or a carrier reassigning an address resets the pass.
  • Read the body, not the status code. Anubis returns HTTP 200 for both challenge and deny pages by default, so a crawler that logs only status codes misreads both.
  • Test before you weigh. Site owners should load the site from carrier and residential networks in the affected countries before shipping a GeoIP or ASN weight.
  • Ask for an allow rule instead of pushing. The policy file can allow a named crawler from a fixed address range, which is the route search engines use.

Read the full guide on proxymint, with the commands, tables and sources.