Not what I said.... your words, not mine. You seem to have some strong opinions against others opinions. Opinions are like arseholes, everyone's got one. The only person responsible for your interpretation of an opinion, is you.
Crazy amount of guests
- Thread starter Levina
- Start date
-
- Tags
- bot swarms guests
Y'all talking about migrating or hosting DNS with Cloudflare or some random provider... I'm over here all "well, I've been self hosting my DNS records since the mid-2000s. No reliance on a third party." 
To be fair, hosting DNS records on a third party that utilizes anycast or is massive-bandwidth capable is excellent as it allows for 1) lowest latency to the resolver for clients, 2) can absorb most attacks to DNS, 3) you don't have to administer and baby various record types and the daemon itself, but... it is harder overall to maintain and keep in proper sync.
The drawback to hosting your entire DNS stack on a third party provider means you literally miss out on first-attempt probing and subsequent attacks to your infrastructure, on top of the fact that you do not get truly granular analytical data, and end up waiting anywhere between 1 and 30 minutes for a record to update and propagate. DNS traffic is pure gold when it comes to 1) infrastructure security preemptive detection (NXDOMAIN responses and RRL notices), 2) your client ISP origins/demographic, 3) general website popularity/interest, and 4) near real time record control.
To each their own on the subject of DNS. I just think hosting DNS yourself and not using a third party is just better.
To be fair, hosting DNS records on a third party that utilizes anycast or is massive-bandwidth capable is excellent as it allows for 1) lowest latency to the resolver for clients, 2) can absorb most attacks to DNS, 3) you don't have to administer and baby various record types and the daemon itself, but... it is harder overall to maintain and keep in proper sync.
The drawback to hosting your entire DNS stack on a third party provider means you literally miss out on first-attempt probing and subsequent attacks to your infrastructure, on top of the fact that you do not get truly granular analytical data, and end up waiting anywhere between 1 and 30 minutes for a record to update and propagate. DNS traffic is pure gold when it comes to 1) infrastructure security preemptive detection (NXDOMAIN responses and RRL notices), 2) your client ISP origins/demographic, 3) general website popularity/interest, and 4) near real time record control.
To each their own on the subject of DNS. I just think hosting DNS yourself and not using a third party is just better.
Also on that note, not sure about others but I have MAAAAANY opinions. Up to biologists now to come up with a proper definition for the polyarseholian mammals
I had the (dis)pleasure of a temporary responsibility for a chunk of the website of my employer at that time, a Fortune 100 company. That's actually a massive overstatement, because in those upper circles of the capitalisphere, the contractual boundaries of the role were so incredibly narrow. Not a single component of the website was under direct control of company employees. The website was entirely outsourced to a media agency, which subcontracted the hosting and security to some other big names (and probably low-paid noobs with occasional oversight of some more experienced L3/L4 people when **** hit the fan). I was merely the single point of contact between my part of the enterprise and the agency's rudimentary internal content management system, where I could submit new content for publication on the site. The submitted content would go through an agency review workflow and end up on a QA website for client sign-off, before another workflow triggered its publishing on the main site. Lots of eyes would scrutinize every word and attachment being published, for conformity with visual identity, PR, legal, regulatory, marketing and some more criteria. If those were checked, the contract requirements were fulfilled.
There were additional technical requirements for availability, for example, but those felt almost like an afterthought put in by sales people because they also needed something technical in there and they just grabbed something vaguely relevant from Wikipedia. (Seen it another time in another Fortune 500 contract for cloud outsourcing, but I digress.) The parameters were generally assimilated with the minimum quality guarantees of any generic off-the-shelf shared hosting, and didn't even have some serious penalties for breaching that SLA.
Technically, the servers were crap, running probably the Internet's last Windows Server with IIS, the website was built on ASP (not even .NET) with a Microsoft Access database backend that would sometimes cause multiple visitors to lock each other out, there was no load balancing of any sort, the DNS was the slowest I have ever seen, and I doubt they had any monitoring, alerts, centralized logging, web application firewalling or other similarly sci-fi (for them) activities attached. Overall it felt like the service was waaaay down the long tail of obsolete technology and the various projects to overhaul it would just reduce the technological debt from "ancient" to "very old". A LAMP stack was in the talks for years as the magical Nirvana but nobody had the technical expertise to lead it and no firm actions were defined in that direction. Not sure if that was because IT (including security) had no say in what was essentially the tool between Marketing, PR, Legal and external media agencies, or because for the external subcontractors it was a fat cow to milk repeatedly instead of getting one project to bring everything up to speed then have only operational billable services and no revenue from improvement projects for years.
It's probably not relevant to generalize from the statistic population of 1 Fortune enterprise. At least in that case, the site may have been created by someone who could get things working (but not necessarily have a thorough architectural design or define a technological lifecycle for it), but was definitely operated at the bare minimum level for (contractual) functionality by technically inept people behind a faceless "professional service".
I share the opinion/arsehole that mastery at running a website is closely related to the website being part of the product being offered and not just a marketing/sales/PR/legal communication tool.
well, given your statement that everyone who is not using Cloudflare is running his website wrong
while 80% of the websites are running happily w/o Cloudflare obviously 80% of the people running websites are "doing it wrong" according to you.
So my interpretation...
... may be a bit exaggerated but it is exactly what you said. Also, given your statement it is rather yourself where your attack is a fit:
I just said that there are alternatives to Cloudflare and given that everyones situation and priorities are different everyone has to find the solution that fits best to his and her needs. Cloudflare does have disadvantages as well, still it may be a proper solution for you - as may other solutions be to other people. It is rather you who does not seem to accept other opinions than your own.
To each their own on the subject of DNS. I just think hosting DNS yourself and not using a third party is just better.
Yes and no.
As you say you'll obviously gain more information when hosting DNS yourself, but on the other hand the question is: How much of technical burden (with all the effort, responisibitly and knowledge needed) are you able or willing to take (or is useful to take) if you just want to run a forum. Time is limited and whatever you put into side quests can't go into your forum directly.If you don't want do take much technical responsibility you can go for XF Cloud or similar hosted offerings, if you want a little more freedom you can go for shared hosting and with a managed server you'll again a bit more. With a VPS or dedicated server you'll gain full freedom and if, on top of that, you decide to host things like email or DNS yourself there is even more freedom - and more responsibility and more knowledge needed. For many, it is no question to go down that route for knowledge reasons anyway, for many others it is the question if they won't profit more if they invest the time needed für building up the knowledge and maintaining the environment is not better invested into the actual forum. Obviously the answer is individual. For my part I decided like 15 years ago that I do not want to run mail servers and DNS servers myself anymore and have barely ever looked back. I had also decided back then I did not want to run actual servers (bare metal or VPS) on the net anymore and have revisited that decision only recently when I decided that shared hosting is becoming too limiting for my forum. Went for a VPS instead of a managed server, currently preparing the move and am still not convinced that I am willing to take the effort longer term. Let's see.
In regards of the thread topic it has been very quiet on my forum over the last weeks. No waves and even the standard amount of bot noise has been at the lower end of the normal range. Almost all have been successfully blocked by my existing ASN and country blocks while BotGuard had an easy life mitigating most of the few that managed to pass the first two barriers to hit it. Also basically almost no new providers/hosters as source of bots - 99,9% came via the usual suspects and were therefor grounded early w/o any effort.Let's get back on topic. Put them away, boys
Last edited:
It's not cost efficient to consume residential proxy hits on locked doors, so I'm glad that (some of) the scrapers at least monitor logs and blacklist domains which are too much effort compared to the next ones. But it's just like the different deterrent layers against burglary - most solutions work against the opportunistic thief, but there's no perfect solution against a determined, resourceful and well prepared perpetrator.
As for the Monday/start of autumn blues riling up conflict, a pause for a big cup of hot chocolate does wonders.
As for the Monday/start of autumn blues riling up conflict, a pause for a big cup of hot chocolate does wonders.
I am not sure that this is the case but have the suspicion as well, given the silence on my forums now after many months of attacks.
Just going back to this. Two "members" joined up last night and this morning - one from India, one from Singapore. Their IP's seem to be residential proxies. One wrote an incredibly normal sounding useful post. The other wrote a normal sounding post linking their article on substack. The article is also normal. However I read somewhere that what they do is get the post approved and then go back to the article and edit it with various spam stuff in it. So it seems the spammers are getting cleverer. I suspect the first authentic seeming post was written from AI information to sound like someone genuinely up on the topic, but it sounds so genuine it's messing with my head!. So I did approve that post and just set restrictions on the account for now. That was the Singapore one. Most bots/guests are from Singapore and China. However there is also a genuine website and community on the topic in Singapore, which muddies the waters a bit.If you're getting persistent random-page-access-like traffic from parts of the world that traditionally would not visit your site, you're possibly having something known as Residential Proxies, aka RESIP's 'browsing' your site. Check out this page if you're curious to learn more: https://ieeexplore.ieee.org/document/10814519 ( https://dl.ifip.org/db/conf/cnsm/cnsm2024/1571050912.pdf )
For example, at varying instances during 2025, I have seen an increase in usage from such foreign IP's, and effectively doing "AI Scraper things". That being random page accesses with no correlation to the previously visited page(s). Such becomes rather apparent with various South American ISP's and Chinese originating clients when I see a slew of browser headersAccept-Languagereportingzh-CNor justzhvia those South American IP addresses. Sure makes you go "hmmmm, well that isn't right!" - especially when its by the hundreds just request flooding the site with no correlation of a normal user 'page to page' navigation (Index -> Forum -> Thread progress).
One can begin applying country code based rate limits or outright blocks, and these AI Scraper companies/institutes then utilize other means to evade being limited/restricted from your resources. I have seen AI Scrapers utilize vast swaths of AWS Datacenter IP ranges, then use various smaller cloud providers that allow rapid spin-up/shutdown of instances all getting their own unique IP addresses. Now it's seemingly using the most round about way possible to grab data, proxies.
I suppose if they were both residential proxies with a blacklist mark for spamrats they could be suspect.
Your forum linked in your signature may have an abusive scraper, or some sort of AI-scraper hammering your site. You can see it occurring in near-real time via your online list (AI clients slamming your
latest content page. Just a FYI.Thanks - yes I can see - mostly from Singapore and China.
Try this site https://www.trendmicro.com and fill out the form there. It protects your forum without the worry of cloudflareI could turn on bot fight mode in cloudflare but somehow I'm a bit nervous about doing it
Not really, nope. If it blocked an API or something that you were using, you would just create a skip rule and bypass everything, but you would know that because x feature would stop working that requires an API. CF have it pretty dialled in. Nothing is perfect, but bot fight mode should be on, as well as Labyrinth.
I'm not even sure if it's working! I tried toggling it on in the Cloudflare app and got an oops message "10400 bad request cannot enable fight mode while Enable JS is disabled." So I logged into cloudflare and turned it on there and it turned on ok. But haven't noticed any reduction in guests in the past hour.
