They sent me into the CF challenge as a logged in user...
... while the forum is populated by "guests" en masse and only very few registered users:
Crazy amount of guests
- Thread starter Levina
- Start date
-
- Tags
- bot swarms guests
... while the forum is populated by "guests" en masse and only very few registered users:
Only short time later the forum got pretty slow and the number of "guests" has doubled in less than one hour:the forum is populated by "guests" en masse and only very few registered users:
So if they did something against bots it clearly wasn't successful. If they did do nothing against bots they should start thinking about it b/c the forum is so slow atm that it is barely usable.
Never seen so many bans on my system. My previous high score is 5000.
Guest count is at ~5600 here.
Looking at my records it looks like two huge networks of amazon crawlers are responsible for a majority of it.
Microsoft is going nuts too with undeclared addresses.
Googlezip is also a large part of the load.
So it's corporates taking down yout site today.
If your system has the ability to lookup an IP and see if it's a datacenter, i'd turn that on.
If you are using fail2ban like me, its ASN ban time.
Guest count is at ~5600 here.
Looking at my records it looks like two huge networks of amazon crawlers are responsible for a majority of it.
Microsoft is going nuts too with undeclared addresses.
Googlezip is also a large part of the load.
So it's corporates taking down yout site today.
If your system has the ability to lookup an IP and see if it's a datacenter, i'd turn that on.
If you are using fail2ban like me, its ASN ban time.
Last edited:
Actually, it is currently more guests than the whole forum has members and we are close to a "statistically one guest per existing thread" ratio. 
In the meantime, the number of guests has dropped from 196.000 to 19.000 within the last 20 minutes - a drop of ~90%.
now, literally minutes later, we are down to 7,5k:
As I had to check the CF "I am as human as it can be" question again, the second time today, I assume they activated under attack mode or something.
now, literally minutes later, we are down to 7,5k:
As I had to check the CF "I am as human as it can be" question again, the second time today, I assume they activated under attack mode or something.
Very interesting, I have a near identical setup to your config file, but no issue using
SV\RedisCache\Redis in both provider fields.
I'm on my third click of that. I'm guessing it's been on for a while.
I'm waiting for the other shoe to drop.
I spent the weekend finishing my design for my protection system after seeing the scraper wave late last week.
The key was queing and batching the proxycheck.io lookups once we got to a certain concurrent connections/second.
Looks like all parts should handle in the millions range now.
Still shocked to see ~180k guests, that's insanely distributed.
I'm waiting for the other shoe to drop.
I spent the weekend finishing my design for my protection system after seeing the scraper wave late last week.
The key was queing and batching the proxycheck.io lookups once we got to a certain concurrent connections/second.
Looks like all parts should handle in the millions range now.
Still shocked to see ~180k guests, that's insanely distributed.
You meant to say "that's insanely abusive", right?
It was a nice try from them... server took it like a champion. Remember, this is running completely open right now, experiment mode, so its all hitting the server.
Last edited:
Just going to say... I think they're really focused on Xenforo forums. That test forum I setup just a couple days ago... none of the wordpress sites on my server were hit, only my main forum, and this test forum on Linode.
It was a nice try from them... server took it like a champion. Remember, this is running completely open right now, experiment mode, so its all hitting the server.
I am wondering: How come that after only a couple of days you see such excessive traffic on a test forum?
Exactly!
Do you have full nginx / apache logs available on web page accesses? I'd be curious to see what led up to the mass-accessing by bots.
It would be there i guess... nginx, running centminmod on that server.
Present for you. Rotated log and current log.
