Fortunately, Roku, which has the largest (28% of TVs), doesn't allow proxies. That said, there are a scary number of exploited TVs out there!
Crazy amount of guests
- Thread starter Levina
- Start date
-
- Tags
- bot swarms guests
Really? we use a Roku... maybe i don't have to convert my TV to be desktop computer driven..
There have been published exploits over the years to get around this, but Roku has been pretty good about security updates.
An interesting little thing - today while asking GPT to do some product research for me, I saw it claim it was using a particular retailers "API" to search for products. So I clicked that to have a look at this so-called API.
A very crude user-agent spoof. Because it had been blocked from accessing it using its properly identifying user-agent.
Again, a crude automation (that worked on this retailer) and it all just happened in the blink of an eye. It won't be long until, probably "unknowingly" to OpenAI and the like, that their agents are off bypassing security of sites even using sophisticated means.
Bash:
bash -lc python - <<'PY'
import requests
urls=['https://www.totaltools.com.au/catalogsearch/result/?q=battery+isolator','https://www.totaltools.com.au/search?q=battery+isolator','https://www.totaltools.com.au/catalogsearch/result/?q=isolator']
for u in urls:
r=requests.get(u,headers={'User-Agent':'Mozilla/5.0'},timeout=20)
print(u,r.status_code,r.url,len(r.text),r.text[:200])
PYA very crude user-agent spoof. Because it had been blocked from accessing it using its properly identifying user-agent.
Again, a crude automation (that worked on this retailer) and it all just happened in the blink of an eye. It won't be long until, probably "unknowingly" to OpenAI and the like, that their agents are off bypassing security of sites even using sophisticated means.
So far for the honesty of the big AI providers and their models and the claim that they would act transparently with their AIs. It is really sickening how the AI companies force the internet to change to a world of distrust and locked doors and deny any responsibility just to foster their own profit.
BTW: Possibly the world starts to slowly wake up regarding scrapers. Over the last weeks I recognized anti-bot measures on websites and forums all over the place on sites that had been freely accessible / unprotected until now. Seems to be a change at scale and started only recently.
If this happens, finally, then things like x402 may actually become viable in time.
Ah.. I know what you're talking about. Does it create random fields for guest posting? I stopped using those sort of things long ago, as it was one of the first things bot got around. Saying that... sometimes old school works well because they all moved on from it. How many times have flares come back!
in opposite to what one could assume it works pretty excellently. It blocked thousands of spam registrations in my forum and in others as well as you can see in the thread for the add on:
However, since most of the spambot registrations seemed to have their source in Russia (independently from where the actual registration came in the end) those attempts have basically come to an almost complete stop after I blocked in my scraping bot fighting efforts Russia entirely and loads of bad ASNs as well. Very welcome collateral damage. This is how it looks over the last months:
Before that it was quite busy: I installed it in November 2024 and, as you can see, it blocked more than 31.500 registration attempts in the 14 months until January 2026 wich makes roughly 2.250 per month (parts of which would have been stopped by XF's built in mechanic otherwise). Does obviously not work agains manual spam registrations but as those typically come from India or Pakistan they don't succeed either and are dropped via other ways.
Registration Spaminator (as well as the other spaminator products) has recently been taken over by Painbaker and the license model changed from "lifelong inc. all updates" to the usual "you need a yearly payment to get updates" - but as there have been barely any it is a bit questionable if that is needed.
![[XB] Registration Spaminator](/community/data/resource_icons/10/10476.jpg?1779001112){kind=icon}
Last edited:
Ok... that's only registration. I don't have a problem with that, from memory, XF has honeypot in the registration as default which is why I don't get registration spam. My issue was one guest posting automated spam. Guest posts have nothing to do with registration. So I think my method to block this one bot at CF was the correct method vs another addon, even if it did handle guest posting with some action between the post and the post landing. Again, XF already has this default, which for my case, ALL got caught and went into moderation because I have it set for any link posted to go into moderation. Its just the annoyance of mass deletion from the moderation queue. One CF rule fixed that for my case, no addons needed.
New server setup 
(centminmod optimised) I wanted to see how it handled, so I disabled the residential proxy rule... 2.25 cpu cores at peak. Easy. It handled 300vu/ps with ease during setup testing (3 million daily equivalent), but its nice to see real world load, where all variables are in play.
(centminmod optimised) I wanted to see how it handled, so I disabled the residential proxy rule... 2.25 cpu cores at peak. Easy. It handled 300vu/ps with ease during setup testing (3 million daily equivalent), but its nice to see real world load, where all variables are in play.
Code:
(starts_with(http.request.uri.path, "/whats-new") or starts_with(http.request.uri.path, "/search"))
and not cf.client.bot
and not http.cookie contains "xf_user="
I'm starting to think they're watching this thread! They shifted to Chrome/143 and Chrome/144 which I didn't have covered, but do now, yet the load bearing /search rule is there for this exact reason.
Code:
(http.user_agent contains "Chrome/99." or http.user_agent contains "Chrome/100." or http.user_agent contains "Chrome/101." or http.user_agent contains "Chrome/103." or http.user_agent contains "Chrome/104." or http.user_agent contains "Chrome/105." or http.user_agent contains "Chrome/106." or http.user_agent contains "Chrome/107." or http.user_agent contains "Chrome/108." or http.user_agent contains "Chrome/109." or http.user_agent contains "Chrome/110." or http.user_agent contains "Chrome/112." or http.user_agent contains "Chrome/116." or http.user_agent contains "Chrome/119." or http.user_agent contains "Chrome/120." or http.user_agent contains "Chrome/123." or http.user_agent contains "Chrome/124." or http.user_agent contains "Chrome/131." or http.user_agent contains "Chrome/133." or http.user_agent contains "Chrome/136." or http.user_agent contains "Chrome/142." or http.user_agent contains "Chrome/143." or http.user_agent contains "Chrome/144." or http.user_agent contains "Chrome/145." or http.user_agent contains "Chrome/146." or http.user_agent contains "Chrome/65." or http.user_agent contains "Firefox/133." or http.user_agent contains "Firefox/135." or http.user_agent contains "Firefox/144." or http.user_agent contains "Firefox/147.") and http.referer eq "" and (not cf.client.bot) and (not http.cookie contains "xf_user")
Yes, that's a very important rule. Everyone using Cloudflare should use it, and if you're not using Cloudflare, keep an eye on your web server logs to see if you're being hit. The amount of abuse our search and whats-new pages have been receiving has been nothing short of ridiculous.
I have all my rules set to non-interactive challenge, so no real person is ever disrupted using the site. I was so excited to see an attack, finally... as I've been wanting good data.
Last edited:
That is some serious abusive attempt to take out your server.
Haven't had much of a problem as my internet security has a similar thing if we're being DDOS attacked as cloudflare.
Works better than cloudflare.
Most bots we had were in the 3000's which had 32 pages of just bots trying to attack us before i asked my Internet security to deal with it.
Now it's down to 10 bots all up to 2 pages
Works better than cloudflare.
Most bots we had were in the 3000's which had 32 pages of just bots trying to attack us before i asked my Internet security to deal with it.
Now it's down to 10 bots all up to 2 pages
It seems they're on a rampage... and /search is just malicious, crawlers aren't hammering search, they just move from page to page, they don't need search. I'm happy though... as I'm getting good data to continuously improve my heuristics scoring. I've never had this much on search though... which really just seem malicious to me... well, attempted and thwarted automatically, yet malicious.
