They finished about midnight, my time. None of the business sites I host were touched by this, this seemed personal to xenforo only.
Crazy amount of guests
- Thread starter Levina
- Start date
-
- Tags
- bot swarms guests
Looks like some of my rules: search, whats-new, reply a.o. on a Managed Challenge. The string quote= too.
Being totally new to Cloudflare, I started with a massive block of countries and a handful of ASN numbers. Guests went down from almost 40,000 to a few hundred. But then the residential proxies kept growing and growing. So I began blocking paths I could block and put a Managed Challenge where I couldn't block. Every time I closed one door they started hammering on another. It was like playing a game of whack-a-mole. But now I seemed to have reached a good balance and my small forum gets about 100 guests now, all looking at normal content. Sometimes numbers go up to between 1000-2000, I'm fine with that as long as they crawl real content. I listened to @Anthony Parsons in an earlier post: Google and the good bots already have it all and he is right, so I'm not fighting that. And those waves dissipate fairly quickly and then I'm back to around 100 guests. I have disabled the country blocks as well and the ASN numbers. My current set-up works for me.
Hi folks. Does anyone have an excessive amount of visitors to the Log in page? The "Log in" path is always my top path on Google Analytics nowadays, and I'm struggling to find any pattern via Cloudflare. Is there a way to add a challenge to XF's log in page without causing issues? Whenever I do so, it affects the log-in pop-up from coming up due to errors and directs users to check the browser console for error details.
EDIT: I've implemented a challenge to all attempts at trying to log in, rather than just opening the pop-up itself. Already seeing a ton of entries. Hopefully this works.
EDIT: I've implemented a challenge to all attempts at trying to log in, rather than just opening the pop-up itself. Already seeing a ton of entries. Hopefully this works.
Last edited:
Likely an account stuffing/rainbow attack. Always a good idea to force challenge those sorts of end points.
Yes! This has been driving me crazy because I could not match up the Google Analytics hits to actual requests in my log file.
Great idea! I've just set this up.
For anyone wondering how, just search your
PAGE_CONTAINER template and remove the data-xf-click="overlay" attribute from both your desktop and mobile login anchor tags.I have paired that with a Managed Challenged Cloudflare rule targeting
(http.request.uri.path in {"/forum/login/" "/forum/register/"}). It's blocked 11 requests just since I started typing this message...
On fail2ban i'm doing rate limiting on the login path(s) for years, works great.
I also expire passwords found in haveibeenpwned, and that's helped too.
I also expire passwords found in haveibeenpwned, and that's helped too.
I have a rate limit on CF for this. I don't have any issues with login or register. Your logs will show /login/keep-alive. My only grievance is the nasty actors trying to maliciously take out my server right now... failing... but still trying nonetheless.
Even after rolling this out, I'm still getting a ton of traffic to the "Log in" page on my XenForo site according to GA4 real-time reports.
It can't be right, as it's a lot more traffic than Cloudflare or my raw logs are reporting.
Something else is going on here, it might be some kind of GA4/XenForo bug. Any ideas?
Unfortunately same.
Now that's funny.
That is helping today, thanks.
Had 19K+ guests trying to hit /search today. A reminder for anybody else using CF rules, if you've changed the default cookie prefix in your config file you'll need use that value instead (eg: If you changed the prefix to wookie you'd use
wookie_user in the rule instead of xf_user).
Curious if anyone has had an excessive amount of US spam traffic as of late, by the way? I notice it's been hitting my XF forum a lot. My developer linked this article to me earlier today:
9to5mac.com
My top ASNs of late are all filled with US ones like Comcast, Verizon, Verizon Business, T-Mobile, etc. Harder to block these when the majority of our traffic is from the US, especially as I'm not seeing any particularly easy to identify patterns - but I've settled on issuing a non-interactive challenge to all US guest traffic using the GET request method. Will be monitoring this for a day or two to see if it helps.
Biggest backdoor yet found in Chinese routers sold under multiple brand names
The most blatant security backdoor yet seen in an internet router has been found in a range of models sold...
9to5mac.com
My top ASNs of late are all filled with US ones like Comcast, Verizon, Verizon Business, T-Mobile, etc. Harder to block these when the majority of our traffic is from the US, especially as I'm not seeing any particularly easy to identify patterns - but I've settled on issuing a non-interactive challenge to all US guest traffic using the GET request method. Will be monitoring this for a day or two to see if it helps.
I had a bad spammer, but fixed it with:
(http.request.method eq "POST"
and http.request.uri.path contains "/post-thread"
and http.user_agent contains "Chrome/1"
and not any(lower(http.request.headers["accept"][*])[*] contains "avif"))
I would use your logs. Isolate the IP's that have actually spammed you, find the similarities for you to use in a CF rule. There may be multiple bad actors. Mine, blocked by the above rule, is using residential proxies, VPN's, there was no way to stop it from conventional means, hence the above rule after a bit of time in the logs. Put your log file on your desktop and let an AI access the log... that will help you quickly.
That bad actor/s for me, started at a handful, then kept creeping up. Last 24hrs, 147 attempts to spam my site, all caught, 0 solved.
(http.request.method eq "POST"
and http.request.uri.path contains "/post-thread"
and http.user_agent contains "Chrome/1"
and not any(lower(http.request.headers["accept"][*])[*] contains "avif"))
I would use your logs. Isolate the IP's that have actually spammed you, find the similarities for you to use in a CF rule. There may be multiple bad actors. Mine, blocked by the above rule, is using residential proxies, VPN's, there was no way to stop it from conventional means, hence the above rule after a bit of time in the logs. Put your log file on your desktop and let an AI access the log... that will help you quickly.
That bad actor/s for me, started at a handful, then kept creeping up. Last 24hrs, 147 attempts to spam my site, all caught, 0 solved.
In 20+ years I've never had a issue with any kind of denial of service attack that wasn't easily handled until earlier in this year when my sites got taken out by the Aisuru-Kimwolf botnet. My understanding from the ISP that manages my server is that compromised smart devices including TVs and streaming devices were responsible for a large proportion of the botnet.
I suspect that the attack was aimed at the ISP rather than my server but it took them a couple of weeks to fully mitigate the attack.
I think it was aimed at as many ISP's and server providers as possible. What do you do with that though? They're all legitimate residential IP's in use by even their own customers.
Even though it's a UK based ISP for UK based customers that's a very relevant question and I believe it did present an issue. In this particular case I think it was found the majority of IPs originated from Brazil and as the majority of my members are either European or US based the ISP was able to whitelist IPs within the danger area and blacklist the rest. It took a while but appeared to work and as far as I know those lists have now been removed.
Anyone else seeing a notable uptick in the past 48 hours of Facebook's bot bearing the UA of
Normally I'm not too concerned, but this is absolutely ignoring robots.txt (not like anyone respects it any more except legacy search engines) and is happening in bursts, very similar to our Asian-scraper botnet friends.
Image above is from one of my Anubis instances blocking whatever is going on with this bot from Meta/Facebook.
Edit; As an update, the Facebook/Meta bots came to a close, then a rather large flood of challenges dished out shortly thereafter.
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) rapidly hitting random pages? From my logs, all of 57.141.4.0/24 in this instance is being utilized to evade rate limiting.Normally I'm not too concerned, but this is absolutely ignoring robots.txt (not like anyone respects it any more except legacy search engines) and is happening in bursts, very similar to our Asian-scraper botnet friends.
Image above is from one of my Anubis instances blocking whatever is going on with this bot from Meta/Facebook.
Edit; As an update, the Facebook/Meta bots came to a close, then a rather large flood of challenges dished out shortly thereafter.
Last edited:
