XF Bot Guard 1.4.1

[zeeb0t]

What I find interesting for my own Australian-based stock trading forum - is that France is the biggest source of scrape attempts. It's interesting how while we have commonalities, some have very different country patterns too. It comes across as intentionally targeted, rather than being broad / generic in nature.

 

[MattW]

I've just had to block this whole /12

csf -d 43.160.0.0/12 "ACEVILLE PTE LTD SG"

 

[Apt Irrelevance]

Wrong thread...
but:

• reduce allowed image size to 1200x1200 px eg
• switch on image optimizer and webp support

Then it should not a problem to upload big pictures, xenforo shrinks them automaticly

Thanks, though I was afraid that would be the solution. We currently have webp optimization turned on but not image dimension limits because we have a lot of people who post hi-res artwork. We do have an attachment file size limit set, but it didn't seem to apply to uploaded avatars and banner images, which is why we set the PHP file limits so low. And of course that makes it so I can't upload this add-on through the admin CP, which is why I asked the question here.

 

[zeeb0t]

Question: We currently have post_max_size and upload_max_filesize set to 8MB to prevent excessively large avatar and banner file uploads. I'd like to increase that to make uploading this add-on more convenient. Does anyone know if Xenforo has another way to limit avatar and banner file sizes?

From what I can tell: XenForo has an attachment file-size option, but that does not control avatars or profile banners. For avatars/banners, XF checks that the upload is a valid supported image and that the server can resize it, then stores resized versions. The main byte-size limit is still PHP’s upload_max_filesize/post_max_size. If you raise those to make add-on ZIP uploads easier, avatar/banner upload attempts can also be larger unless you enforce a lower limit at the web server/proxy level or with custom XF code.

 

[Chromaniac]

have you considered bundling the bundle as a separate addon. similar to how xon has a standard library. i imagine it would not be required to update so frequently? having a 30MB update every single time can be a bit annoying lol.

 

[zeeb0t]

have you considered bundling the bundle as a separate addon. similar to how xon has a standard library. i imagine it would not be required to update so frequently? having a 30MB update every single time can be a bit annoying lol.

I am looking at moving the mmdb files used for IP to country/ASN into a downloaded resource by the add-on. So, it would download it's copy regularly from my own server, thus making the add-on file smaller again.

 

[Chromaniac]

is this an issue that needs to be resolved? i have ran the XF Bot Guard known crawler refresh command a few times manually and it remains like that . though it seems unrelated to the above warning.

 

[Apt Irrelevance]

Show off your map time

This is good, right?

Not currently blocking any countries or ASN's so that'll make for a more colorful map. Though I am kinda bummed we don't have any Antarctic participation...

 

[woody]

 

[zeeb0t]

View attachment 340467

is this an issue that needs to be resolved? i have ran the XF Bot Guard known crawler refresh command a few times manually and it remains like that . though it seems unrelated to the above warning.

Ignore that, it is just warning the mmdb files are over 24 hrs old. But, it is expected as they currently only get updated when I release a new version - and then is "outdated" after 24 hours. Once I make it so the add-on keeps the mmdb files updated (downloaded from my server) the warning will go away.

 

[zeeb0t]

Though I am kinda bummed we don't have any Antarctic participation...

Haha, me too. When I saw someone had that... I was like hey! No fair lol.

 

[zeeb0t]

View attachment 340468

A whole world (almost) of bots!

 

[Apt Irrelevance]

Collect them all!

 

[Chromaniac]

Insane to see india being source of so many bots? Bandwidth is generally expensive here. I guess we are home to compromised routers and iot devices like televisions.

 

[dutchbb]

Insane to see india being source of so many bots? Bandwidth is generally expensive here. I guess we are home to compromised routers and iot devices like televisions.

And microsoft tech support.

 

[Black Tiger]

Anyone tested this with Brave browser? I read from a user who logged out (other forum than mine) and cleared cookies but did not get a message from bot-guard when trying to read the forums as guest, while somebody else with Firefox did.
I don't have any Brave browser, so can't test.

 

[Rhody]

Show off your map time

 

[zeeb0t]

Anyone tested this with Brave browser? I read from a user who logged out (other forum than mine) and cleared cookies but did not get a message from bot-guard when trying to read the forums as guest, while somebody else with Firefox did.
I don't have any Brave browser, so can't test.

Can you clarify what you mean by "message from Bot guard"? If you meant the CAPTCHA - Bot Guard is not designed to simply hand out CAPTCHA, it all depends on a number of heuristic risk signals.

 

[zeeb0t]

View attachment 340468

Well done sir.

 

[duderuud]

That world map doesn't work here, also got an error:

No mappable country pressure data is available for this range.

and

The bundled IPLocate country or ASN database could not be validated. Bot Guard will ignore unavailable local geo lookup data and continue to fail open.

@zeeb0t How can I debug this?