Crazy amount of guests

[smallwheels]

I addressed this issue on my site when I had a massive issue a while back https://xenforo.com/community/threads/need-help-with-stopping-bots-spammers.232846/

I could assist people on this site for a fee

Hmm, this was in August last year, you "massive issue" were 300 guests and you had absolutely no clue what to do.

Right now we have over 300 "guests" viewing our site. I'd like to block the bad bots and the spammers trying to register, but I'm not sure sure where to start. If someone can give me a quote that would be great.

Your knowledge at that time seems dubious at best, as can be seen in this post from the same thread:

Yes i have robots.txt. I'm not sure tbh

I installed Cloudfare Turnstile and still the same @rambler.ru spammers are signing up. I've blocked their email but it still creates an account which is annoying

Now we have a thread with people from all over the world discussing the bot problem at scale and in depth and developing strategies and solutions, some of them really sophisticated. All for free and to learn and help others.

Now you pop up out of nowhere, having not participated on here and having abosolutely no credible track record in the field of bots, running a forum with 524 members - and all you say is:

I could assist people on this site for a fee

Whatever "this site" shall mean.

Don't you think advertising commercial services in this thread may be completely inadequate? And don't you think you may overestimate your own abilities dramatically?

 

[Wildcat Media]

If that was a genuine project, multiple highly skilled people would have been involved and got paid. If you are not scared of where AI is currently heading you really should be.

That's a point also. The music industry itself has turned into a dead end. I know you're aware of it. Back in the 70s and 80s, a hit record could make millions. These days, streaming a song results in, what, a fraction of a penny paid to the composer and artist? The big labels have pretty much forced many musicians and bands to go independent by self-releasing or using smaller boutique labels to get their music out there. Promotion arguably is easier on one hand (artists can self-promote through YouTube, social media, etc.) yet the big money machine isn't accessible to anyone unless they have a lot of popularity going in, and/or can be groomed to become a chart topper. (Note that talent has little to do with it--look at what's in the Top 40 today as opposed to a few decades ago.)

When I still did some work for a band (they are a popular jazz combo), they would get income from sales of the latest release, and composing royalties would trickle down to them months later. They didn't make money on touring, but it did boost record sales; any remaining money they split up four ways equally. These days, any band touring has to count on the tours to make them money, so that in turn boost the ticket prices. Which also, in turn, drives people like me away from seeing the bigger acts out there touring.

And once we throw AI slop into the mix...when will we get to the point where people recording in home studios won't even have to record music ever again? They can type prompts into a keyboard and turn out slop that is plagiarized from all the music ever recorded in the past. Sickening, really.

It's like the world (especially the tech world) doesn't want art to exist anymore.

 

[smallwheels]

I am starting to wonder if either CF have rolled something out OR the people behind the bots are having a reset and recalibration for the next round. I have literally every bot blocking setting turned off, zero rules, nothing, and the traffic is primarily legit people and crawlers since last months peak.

Possibly they have seen enough of your forum and turning to others - i.e. mine has a continouosly rising number of bots for a couple of days now:



Last 24h:

Short of 4.000 came from the US alone - by far the biggest and most annoying source of bots. On number two is currently the UK with just 233 bots.

 

[Greenandgold]

Hmm, this was in August last year, you "massive issue" were 300 guests and you had absolutely no clue what to do.

Your knowledge at that time seems dubious at best, as can be seen in this post from the same thread:


Now we have a thread with people from all over the world discussing the bot problem at scale and in depth and developing strategies and solutions, some of them really sophisticated. All for free and to learn and help others.

Now you pop up out of nowhere, having not participated on here and having abosolutely no credible track record in the field of bots, running a forum with 524 members - and all you say is:


Whatever "this site" shall mean.

Don't you think advertising commercial services in this thread may be completely inadequate? And don't you think you may overestimate your own abilities dramatically?

If I did it on my own, I could do it for others. It's quite self explanatory. I believe what I set up would work for others tbh

 

[smallwheels]

If I did it on my own, I could do it for others. It's quite self explanatory. I believe what I set up would work for others tbh

Good, so the whole thread here is obviously useless and all the participants are simply to stupid to figure out how to do it on their own. The question is then: Why are you trying to make a profit out of your "knowledge" if it is all so simple and all the others in this thread give away their knowledge for free?

And, as you complained about spammers on your forum - why do you ignore the rules of this forum?

Please do not attempt to sell or trade any products or services in our community, outside what is explicitly allowed in the resource manager or third-party services forum. This rule also extends to give aways and competitions. You should head to a dedicated site for that.

Highjacking a volunteer support thread and instead of helping others just using it trying to sell your "service" not only gives you a bad reputation but also is a strict no-no according to the rules and therefore effectively Spam.

 

[Anthony Parsons]

Don't you think advertising commercial services in this thread may be completely inadequate? And don't you think you may overestimate your own abilities dramatically?

Come on... I did leave a laugh on their post. I thought it was funny.

mine has a continouosly rising number of bots for a couple of days now

Kinda fascinating how they move. I honestly don't believe the harsh invasions are for content, I think a group is out there causing havoc, and the why? is what I am curious about. I have tuned my server close to perfection... the thing can handle stuff being thrown at it, and I guess the chaos crew can only throw so much havoc at any site because the moment they cross a threshold it would be considered DDOS and then things get handled vastly different by DNS providers. So much of the havoc isn't content, its just looking for intrusion and exploits. I'm not dismissing the corporate players abuse that is happening... but I can't put my finger on it... there is this other component out there trying to cause trouble, but its not about content.

 

[smallwheels]

So much of the havoc isn't content, its just looking for intrusion and exploits.

Sure, but this is is the minority and the usual noise that has existed forever. As I am in the process of setting up a new server atm I had an empty Webserver running for a couple of days that just had a DNS entry, nothing more. No content, no links to it, no sitemaps, no search engine entries - just an empty box. It took only a couple of hours until the first vultures arrived and it hasn't stopped since then. However: The absolute volume is low in comparison and indeed those "visitors" are targeting weaknesses and other more or less common URLs. There is a bit of an overlap with those targeting my forum, regarding where they come from, but it is rather small. For the most part these are completely different ASNs (apart from Microsoft Azure, Akamai Cloud, Google Cloud, Alibaba Cloud and a hand full of other ASNs that I've seen in the logs of my forum server as well), Dialup/Cable networks are barely present at all and clearly not the herds of residential proxies - those are all datacenter or commercial ASNs. A lot of them well known for misbehavior and a couple of others that were new to me, but fit the usual pattern of bad ASNs.

So you are right: there are clearly at least two different cohorts of intention, but the "scanning for weaknesses" cohort isn't new and maybe this kind of traffic has gone up as well a bit - but I don't really see a dramatic change regarding this cohort as far as I can judge.

 

[BrettC]

Interesting little probing hit this morning from our local asian botnet friends on AS132203 (Aceville PTE aka TenCent)...

[2026-07-12T02:57:22-05:00] "150.109.107.60" "-" "GET /ip HTTP/1.1" "301" 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "-" "244446" "1" "196"
[2026-07-12T02:57:22-05:00] "119.28.81.192" "-" "GET /ip HTTP/1.1" "301" 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "-" "244448" "1" "196"
[2026-07-12T02:57:22-05:00] "43.173.74.11" "-" "GET /ip HTTP/1.1" "301" 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "-" "244443" "1" "196"
[2026-07-12T02:57:22-05:00] "43.156.187.39" "-" "GET /ip HTTP/1.1" "301" 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "-" "244454" "1" "196"
[2026-07-12T02:57:22-05:00] "43.153.40.190" "-" "GET /ip HTTP/1.1" "301" 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "-" "244442" "1" "196"
[2026-07-12T02:57:22-05:00] "43.132.154.187" "-" "GET /ip HTTP/1.1" "301" 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "-" "244456" "1" "196"
[2026-07-12T02:57:22-05:00] "43.134.32.26" "-" "GET /ip HTTP/1.1" "301" 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "-" "244452" "1" "196"
[2026-07-12T02:57:22-05:00] "43.153.19.102" "-" "GET /ip HTTP/1.1" "301" 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "-" "244449" "1" "196"
[2026-07-12T02:57:23-05:00] "43.134.135.163" "-" "GET /ip HTTP/1.1" "301" 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "-" "244458" "1" "196"
[2026-07-12T02:57:23-05:00] "129.226.186.11" "-" "GET /ip HTTP/1.1" "200" 2450 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "-" "244445" "1" "196"
[2026-07-12T02:57:23-05:00] "43.129.210.113" "-" "GET /ip HTTP/1.1" "200" 2450 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "-" "244447" "1" "196"
[2026-07-12T02:57:23-05:00] "43.173.76.206" "-" "GET /ip HTTP/1.1" "200" 4531 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "-" "244441" "1" "196"
[2026-07-12T02:57:23-05:00] "43.153.12.230" "-" "GET /ip HTTP/1.1" "200" 2450 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "-" "244444" "1" "196"
[2026-07-12T02:57:23-05:00] "43.129.239.3" "-" "GET /ip HTTP/1.1" "200" 2450 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "-" "244453" "1" "196"
[2026-07-12T02:57:23-05:00] "43.134.59.123" "-" "GET /ip HTTP/1.1" "200" 2450 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "-" "244450" "1" "196"
[2026-07-12T02:57:23-05:00] "43.173.76.206" "-" "GET /ip HTTP/1.1" "200" 4531 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "-" "244451" "1" "196"
[2026-07-12T02:57:23-05:00] "43.128.122.128" "-" "GET /ip HTTP/1.1" "200" 2457 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "-" "244457" "1" "196"
[2026-07-12T02:57:23-05:00] "43.153.209.92" "-" "GET /ip HTTP/1.1" "200" 2450 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "-" "244455" "1" "196"

 

[Rhody]

What do you make of this? I have been getting hit hard with these for over a week now, usually about 40,000 bot sessions. It went as high as 88,000. They seem to be from all over the place, and are targeting a specific post within a private subforum that an unregistered session would never be able to see. (I have since deleted the thread/post, but it makes no difference)

I added cloudflare and xf botguard 4 weeks ago, which have reduced how often the sql is crashing. But it is excessive and I'm not sure what to do about it. There are so many different ASNs involved in this coordinated behavior.

2600:8805:1e04:d100:5404:2bb6:7d69:83c9 - - [11/Jul/2026:08:07:48 -0400] "POST /bot-guard/collect HTTP/1.1" 200 79 "https://www.MYACTUALDOMAIN_FILTEREDOUT/index.php?threads/the-secret-shopper-came-today.27605/post-318409" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
142.147.214.135 - - [11/Jul/2026:08:07:48 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1149 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
93.157.108.240 - - [11/Jul/2026:08:07:49 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1150 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
84.37.98.233 - - [11/Jul/2026:08:07:49 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1149 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
142.147.179.124 - - [11/Jul/2026:08:07:49 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1150 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
104.253.165.138 - - [11/Jul/2026:08:07:49 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1151 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
138.226.24.18 - - [11/Jul/2026:08:07:50 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1151 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
104.253.165.199 - - [11/Jul/2026:08:07:50 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
142.147.161.177 - - [11/Jul/2026:08:07:50 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1148 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
50.31.139.173 - - [11/Jul/2026:08:07:51 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1152 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
2600:4040:9d75:be00:992f:7a1f:7835:7e75 - - [11/Jul/2026:08:07:48 -0400] "POST /index.php?sam-item/87/track-view HTTP/1.1" 200 167 "https://www.MYACTUALDOMAIN_FILTEREDOUT/bot-guard/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1"
84.37.49.252 - - [11/Jul/2026:08:07:48 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1147 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
68.167.134.92 - - [11/Jul/2026:08:07:48 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1150 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
154.17.146.22 - - [11/Jul/2026:08:07:49 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
170.23.16.47 - - [11/Jul/2026:08:07:49 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1169 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
84.37.229.147 - - [11/Jul/2026:08:07:49 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1168 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
64.57.129.6 - - [11/Jul/2026:08:07:49 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1145 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
2600:8805:1e04:d100:5404:2bb6:7d69:83c9 - - [11/Jul/2026:08:07:49 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 303 0 "https://www.MYACTUALDOMAIN_FILTEREDOUT/index.php?threads/the-secret-shopper-came-today.27605/post-318409" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
172.84.176.54 - - [11/Jul/2026:08:07:50 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1149 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
2600:8805:1e04:d100:5404:2bb6:7d69:83c9 - - [11/Jul/2026:08:07:50 -0400] "GET /bot-guard/ HTTP/1.1" 200 10938 "https://www.MYACTUALDOMAIN_FILTEREDOUT/index.php?threads/the-secret-shopper-came-today.27605/post-318409" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
84.37.34.117 - - [11/Jul/2026:08:07:51 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1142 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
159.148.204.220 - - [11/Jul/2026:08:07:51 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1153 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
142.147.170.227 - - [11/Jul/2026:08:07:51 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1150 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
205.234.147.188 - - [11/Jul/2026:08:07:53 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1149 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
192.154.196.108 - - [11/Jul/2026:08:07:54 -0400] "GET /js/zee/botguard/fingerprintjs/fp.min.js?v=1040070 HTTP/1.1" 200 14239 "https://www.MYACTUALDOMAIN_FILTEREDOUT/index.php?threads/the-secret-shopper-came-today.27605/post-318409" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
85.208.189.164 - - [11/Jul/2026:08:07:54 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1148 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
172.84.176.196 - - [11/Jul/2026:08:07:54 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1169 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
213.201.171.240 - - [11/Jul/2026:08:07:54 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1150 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
159.148.126.216 - - [11/Jul/2026:08:07:51 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1151 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
192.154.196.108 - - [11/Jul/2026:08:07:52 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1168 "https://www.google.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
167.160.59.57 - - [11/Jul/2026:08:07:52 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1145 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
192.154.196.108 - - [11/Jul/2026:08:07:53 -0400] "GET /js/zee/botguard/botguard.js?v=1040070 HTTP/1.1" 200 10969 "https://www.MYACTUALDOMAIN_FILTEREDOUT/index.php?threads/the-secret-shopper-came-today.27605/post-318409" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
166.88.89.122 - - [11/Jul/2026:08:07:53 -0400] "GET /bot-guard/ HTTP/1.1" 200 11593 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
142.147.172.229 - - [11/Jul/2026:08:07:53 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1148 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
136.0.63.37 - - [11/Jul/2026:08:07:54 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1153 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
154.30.101.105 - - [11/Jul/2026:08:07:54 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1151 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
185.211.96.61 - - [11/Jul/2026:08:07:54 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1152 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
142.147.169.48 - - [11/Jul/2026:08:07:54 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1167 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
192.154.196.108 - - [11/Jul/2026:08:07:55 -0400] "POST /bot-guard/collect HTTP/1.1" 200 79 "https://www.MYACTUALDOMAIN_FILTEREDOUT/index.php?threads/the-secret-shopper-came-today.27605/post-318409" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
85.208.191.185 - - [11/Jul/2026:08:07:55 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1152 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
152.232.150.65 - - [11/Jul/2026:08:07:56 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1148 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
107.174.200.179 - - [11/Jul/2026:08:07:56 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1151 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
104.253.179.128 - - [11/Jul/2026:08:07:56 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1147 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
192.154.196.108 - - [11/Jul/2026:08:07:56 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 303 0 "https://www.MYACTUALDOMAIN_FILTEREDOUT/index.php?threads/the-secret-shopper-came-today.27605/post-318409" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
154.29.237.53 - - [11/Jul/2026:08:07:57 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1148 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
213.201.252.61 - - [11/Jul/2026:08:07:57 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1152 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
205.234.254.166 - - [11/Jul/2026:08:07:58 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1148 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
192.154.196.108 - - [11/Jul/2026:08:07:59 -0400] "GET /bot-guard/ HTTP/1.1" 200 10917 "https://www.MYACTUALDOMAIN_FILTEREDOUT/index.php?threads/the-secret-shopper-came-today.27605/post-318409" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
45.95.25.172 - - [11/Jul/2026:08:07:59 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1153 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
185.47.93.240 - - [11/Jul/2026:08:07:59 -0400] "GET /index.php?threads/the-secret-shopper-came-today.27605/post-318409 HTTP/1.1" 200 1151 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"

 

[smallwheels]

are targeting a specific post within a private subforum that an unregistered session would never be able to see.

I would add the URL as hard blocked to the Firewall / WAF as far out as possible from XF (so possibly at CF level), so these requests don't even reach the application. If it is not possible on CF maybe you have a Firewall on your server and if you don't .htaccess or the nginx config are there to help you. If the request does not reach XF you should not have issues with your db at all.

If you know what resident proxy provider they are using you could also be a bit nasty and redirect requests to this URL to the homepage of that proxy provider, so that (in theory) they would bomb themselves out of the web. Won't work unfortunately, as most of them are behind Cloudflare themselves, as shown earlier up this thread and you don't know which proxyprovider to tackle anyway.

 

[webbouk]

We've been pretty much steady away since the last attack, five/six days ago...

 

[webbouk]

With @digitalpoint 's App for Cloudflare there is a drop down for various security settings with Cloudflare, including UAM ....

Ours is set to 'High'



One thing I did find is that when we were under attack I had to enable UAM from within Cloudflare as I couldn't access the XF ACP to do so within the App due to high level of resources being used.

However, turning UAM off from within Cloudflare effectively turned off all security levels. Something I missed initially.
Digitalpoint's app makes it a lot simpler process to set the security level when required.

 

[Rhody]

With @digitalpoint 's App for Cloudflare there is a drop down for various security settings with Cloudflare, including UAM ....

Ours is set to 'High'

View attachment 341362

One thing I did find is that when we were under attack I had to enable UAM from within Cloudflare as I couldn't access the XF ACP to do so within the App due to high level of resources being used.

However, turning UAM off from within Cloudflare effectively turned off all security levels. Something I missed initially.
Digitalpoint's app makes it a lot simpler process to set the security level when required.

I do have mine set to high security

 

[Rhody]

I would add the URL as hard blocked to the Firewall / WAF as far out as possible from XF (so possibly at CF level), so these requests don't even reach the application. If it is not possible on CF maybe you have a Firewall on your server and if you don't .htaccess or the nginx config are there to help you. If the request does not reach XF you should not have issues with your db at all.

This actually seems to be working.

Within 5 minutes of adding the rule URI contains /index.php?threads/the-secret-shopper-came-today.27605/post-318409 it already hit over 5k times.

 

[ES Dev Team]

It's very disturbing. My daughter went to art school and graduated five years ago, just before all of this AI nonsense exploded. She, her art school friends and roommates (many of them still hang out together), and the art community in general, is completely against what AI is doing to their livelihood. Even with her roomies, all three of them in the house work in non-art-related jobs.

Right before the AI boom, huh? that's gotta suck.
Creative work has always been tough, and it gets a lot tougher during crappy economic conditions like now.

It's turning into a class division--AI is funded and promoted by Big Tech with their billions of dollars and multi-billionaire CEOs, while those of us without billions are the ones who are "paying" for this with misleading AI slop content, AI taking away jobs, AI hammering sites run by people like us, AI feeding us incorrect answers when we ask it questions...all to pad the pockets of the stockholders of AI oligarchs.

If the average person doesn't pick up the same tools to compete, then big tech using those tools will create the situation you describe.
( in addition to mass content theft that they look like they're gonna get away with )

Consider for a second, a contrary view.

The difference between slop and art, when using AI, is the taste, interesting ideas, and guidance that a skilled artist can provide.

Also, AI is very useful as a turbo-muse. For graphic design, i often feed the AI a hand drawn sketch, then use AI to generate iterations of an idea. It helps me get to the final idea, then i can draw the final result with AI, or by hand.

For example, here's a quick input i did in photoshop.



From there, we can iterate until the concept looks right. AI can do this enormously faster than me, so hell yeah, i'm using it for this.



There also exist AI models that are specialized at:

• pose a character based on a prompt
• turn a 2d image into a 3d model
• make difficult edits to an image based a prompt
• etc

With coding, i'm generally fighting AI with AI lately. I design a traffic analysis or some protections against AI scrapers often, with me doing the design, AI writing the code, and me doing testing. I can usually design and implement a response to a new problem in 1/5 the time.

A lot of other coding tasks are done by hand. But i figured out how to get AI to help me with the boring parts of the process without sacrificing the output quality.

It's possible to use AI to enhance your output as someone who is highly skilled and picky about details.

 

[Anthony Parsons]

Within 5 minutes of adding the rule URI contains /index.php?threads/the-secret-shopper-came-today.27605/post-318409 it already hit over 5k times.

This is what I talked about a handful of posts back... there seems to just be a whole bunch of malicious intent in some of this traffic, not actually going after content itself.

 

[smallwheels]

This is what I talked about a handful of posts back... there seems to just be a whole bunch of malicious intent in some of this traffic, not actually going after content itself.

Could also simply be a misconfigured bot, that fails to go through the URL-lists properly. The good thing is: If you have thousands of IPs that all call the same, very odd URL you can be pretty sure that there is the same actor behind it. That up to maybe 10 of these bots call the same old URL is parallel is pretty common - 80.000 times is just stupid.

 

[Rhody]

Not just 10, it was organized with thousands of bots from data centers all over the world.

Cloudflare blocked over 12k in that first hour, traffic is back to normal.

 

[Anthony Parsons]

Cloudflare blocked over 12k in that first hour, traffic is back to normal.

Yer, I have seen this weird stuff in mine, it was malicious, not trying to get content. I've had over 100k at once try... but it barely blipped the server, so they gave up by themselves. Seen it mixed with multiple attempts on my server.

 

[smallwheels]

thousands of bots from data centers all over the world

I did check a couple of the IPs yesterday from the log snippet you posted and indeed it seemed to be all IPs from data centers. Allmost all well known for this kind of behavior for ages. ASNs like Host Royal, Ace Datacenters, Datacamp Ltd. etc.

If you have the logs it would be interesting to filter them for the calls to that URL and to feed the IPs into a script to check against Maxmind to find out the ASNs and group them with the aggregated requests. With a dataset as huge as your's that is completely clean of legitimate requests this would give an interesting picture about bad ASNs and the frequency/distribution between them.

I bet that like 95%-99% of those ASNs can be blocked w/o any harm for your forum and this way prevent things like what happened to you to happen again tomorrow, just with a different target URL as well as a lot of the usual bot scraping attacks.

The logs can be filtered with a simple grep, the IPs extracted with a simple awk and a script for feeding them in batch to a local Maxmind DB can probably be built within minutes by any AI (even the simpler variants that are integrated in i.e. the Bing search). The Maxmind DB is free to download and with the amount of IPs to check this makes total sense.

This way you could create a very interesting inside with minimal work involved and with a 100% safety uncover quite a bunch of bad actors.

The outcome could be a table like "ASN", "number of requests", "number of different IPs requesting from that ASN"