Buehler, buehler....anyone, anyone else just notice....

maybe it's another solar flare code issue during the 'minimum'...

These ********: https://whois.domaintools.com/185.191.171.44

SEMRush.com .... they were hammering the site as fast as they could.

Their entire subnet is now banned.

That got most of it. Let's finish mopping up:

https://whois.domaintools.com/94.19.211.216

Boom outta here.

You're gone too

https://whois.domaintools.com/91.78.79.250

And you're gone tor-exit-relay-5.anonymizing-proxy.digitalcourage.de

You're gone too https://www.whois.com/whois/5.2.69.7

And you're gone https://www.whois.com/whois/84.17.49.132

That's dropped the amount of traffic coming in by more than half. And LuxembourgTor8.lu gets a ban too.

And you too tor.plutex.de

I banned everybody above's entire subnet ... literally their entire IP allocation from ICANN. Traffic coming in is now 80% less. Pour one out for our Russian, Cyprus, and Netherlands based bots/trolls.

Much appreciated!

I have no idea what in the world you're talking about...but the improvement in speed is noted.

Thanks.

A visual of what GTS did:

And you get a ban: https://www.whois.com/whois/185.104.184.118


And you get a ban: tor5e3.digitale-gesellschaft.ch


And you get a ban: https://www.whois.com/whois/51.38.80.41


And you get a ban: https://www.whois.com/whois/217.182.138.4

Yes, I have noticed at least the last 3 weeks the message boards have been really slow to load and navigate different pages.

And you get a ban: https://www.whois.com/whois/51.68.212.168

And you get a ban: https://www.whois.com/whois/185.220.100.254

(12-30-2020 01:18 PM)epasnoopy Wrote:  Yes, I have noticed at least the last 3 weeks the message boards have been really slow to load and navigate different pages.

Around 2-3 weeks ago we broke the thread views mechanism on the board. Part of that is old long arse threads on popular boards. Part of it is is the threads table in the DB is just too massive and the volume of traffic too high to do every single thread view update on demand. So I rewrote that portion of the board so it adds up all the changes it wants to do then pushes one big update every minute. This bypasses about 95% of the queries, since instead of adding 1 120 times to one thread we add 120 once to that thread.

Since then it's been nice and snappy. Until bot-a-geddon today.

(12-30-2020 01:19 PM)georgia_tech_swagger Wrote:  And you get a ban: https://www.whois.com/whois/51.68.212.168

And you get a ban: https://www.whois.com/whois/185.220.100.254

(12-30-2020 01:14 PM)georgia_tech_swagger Wrote:  And you get a ban: https://www.whois.com/whois/185.104.184.118


And you get a ban: tor5e3.digitale-gesellschaft.ch


And you get a ban: https://www.whois.com/whois/51.38.80.41


And you get a ban: https://www.whois.com/whois/217.182.138.4

(12-30-2020 01:21 PM)georgia_tech_swagger Wrote:  

(12-30-2020 01:18 PM)epasnoopy Wrote:  Yes, I have noticed at least the last 3 weeks the message boards have been really slow to load and navigate different pages.

Around 2-3 weeks ago we broke the thread views mechanism on the board. Part of that is old long arse threads on popular boards. Part of it is is the threads table in the DB is just too massive and the volume of traffic too high to do every single thread view update on demand. So I rewrote that portion of the board so it adds up all the changes it wants to do then pushes one big update every minute. This bypasses about 95% of the queries, since instead of adding 1 120 times to one thread we add 120 once to that thread.

Since then it's been nice and snappy. Until bot-a-geddon today.

What's the point of the bot attack? What do they get out of slowing down a college sports message board?

Oh fun! Good job identifying and blocking those subnets. I wonder if I still have a hard drive with some old eggdrops on it.

*runs off to watch the stream of ips hit our firewalls.*