System Update - Software Update

[Scott Greczkowski]

Good morning,

Over the past few weeks I have been working on an issue that has been bugging me. If you look at the amount of people online it shows there are thousands online at any time. I have tried figuring out why this user count is so high. And I installed a new program a few weeks ago which gave me some better insight. (You can see some of these stuff here. https://www.satelliteguys.us/xen/statistiche/ Although some of the stats are only seen on admin accounts) It is bots and cyber attacks on the site. We had a large amount of traffic coming from China, Russia, Vietnam an other places which I blocked on our firewall, which greatly reduced the guest traffic to the site.

However after a few days the traffic started going up again and looking at things it is traffic from other countries. I can keep blocking them, but the more we block the slower the site gets as the firewall needs to process more to check the traffic for allowed and not allowed.

So I started working with our forum software vendor who tell me that a majority of our traffic is bots... and most of these bots from from foreign countries.

They tell me I should block the bots from a robots.txt file on the server and that should get rid of most of them. I asked them how do I know which bots to block and they had me install a bot addon that is a service that detects and keeps a list of all bots. I am supposed to be able to go to Current visitors and see a list of them to which I can add ones I feel are not legit to the rebots.txt file. The only problem is if I go to Current visitors it tells me "No Results Found" the does the same for Guests Current visitors so I put in another ticket with them.

Anyways about 3 weeks ago they put out a new version of the software which fixes many... many bugs (You can see a list of fixes at XenForo 2.3.8 & Add-ons Released) and before they will help me with the robots and guest not showing in the Who's Online list I need when I upgrade to the latest version.

So for a few minutes I will be closing the site and doing this upgrade. The site will be down only for a few minutes.

And for those wondering... Yes TVGUYS.US is coming... just not today.

So we will be back in a few moments.

 

[Scott Greczkowski]

Ok update is done... Now to test things.

 

[Scott Greczkowski]

Ok update and still "no results found" for guests and robots. So ticket submitted.

 

[Scott Greczkowski]

Looking around on Xenforo.COM it seems this is a issue to lots of sites.

Crazy amount of guests

We have completely blocked Bytespider, ByteDance, and BytePlus. They're just a waste of bandwidth and server resources. .

xenforo.com

 

[Foxbat]

Thanks for updating the site, Scott! It seems to have fixed some of the iPadOS 26 issues with editing that bugged me.

 

[Juan]

Good morning,

Over the past few weeks I have been working on an issue that has been bugging me. If you look at the amount of people online it shows there are thousands online at any time. I have tried figuring out why this user count is so high. And I installed a new program a few weeks ago which gave me some better insight. (You can see some of these stuff here. https://www.satelliteguys.us/xen/statistiche/ Although some of the stats are only seen on admin accounts) It is bots and cyber attacks on the site. We had a large amount of traffic coming from China, Russia, Vietnam an other places which I blocked on our firewall, which greatly reduced the guest traffic to the site.

However after a few days the traffic started going up again and looking at things it is traffic from other countries. I can keep blocking them, but the more we block the slower the site gets as the firewall needs to process more to check the traffic for allowed and not allowed.

So I started working with our forum software vendor who tell me that a majority of our traffic is bots... and most of these bots from from foreign countries.

They tell me I should block the bots from a robots.txt file on the server and that should get rid of most of them. I asked them how do I know which bots to block and they had me install a bot addon that is a service that detects and keeps a list of all bots. I am supposed to be able to go to Current visitors and see a list of them to which I can add ones I feel are not legit to the rebots.txt file. The only problem is if I go to Current visitors it tells me "No Results Found" the does the same for Guests Current visitors so I put in another ticket with them.

Anyways about 3 weeks ago they put out a new version of the software which fixes many... many bugs (You can see a list of fixes at XenForo 2.3.8 & Add-ons Released) and before they will help me with the robots and guest not showing in the Who's Online list I need when I upgrade to the latest version.

So for a few minutes I will be closing the site and doing this upgrade. The site will be down only for a few minutes.

And for those wondering... Yes TVGUYS.US is coming... just not today.

So we will be back in a few moments.

Any way you can force bots to click on ads?

 

[Scott Greczkowski]

I have added a new security service (CleanTalk)to the site. CleanTalk services a number of functions.
Anti-spam features:

1. Stop spambots at registrations.
2. Stop spambots from the orders.
3. Contact form protection (CAPTCHA should be disabled!).
4. Allow guest posting on the forum without CAPTCHA.

Anti-Spam info
We have developed an anti-spam extension for XF 2 that provides maximum protection from spam. This allows you to offer your visitors a simple and convenient form for posts and registrations without the annoyance of CAPTCHA or puzzles.

We use a multi-stage spam detection test that allows us to block up to 100% of spambots.

SpamFireWall
CleanTalk includes an advanced feature called SpamFireWall, which blocks the most active spambots before they even gain access to your website. It prevents the loading of pages of the website by spambots, so your web server doesn't need to perform all scripts on these pages. Also, it prevents the scanning of pages of the website by spambots. Therefore, SpamFireWall can significantly reduce the load on your web server.

SpamFireWall also makes CleanTalk a two-step protection from spambots. SpamFireWall is the first step, and it blocks the most active spambots. CleanTalk Anti-Spam is the second step, and it checks all other requests on the website at the moment before submitting comments/registering, etc.

Low false/positive rate
This extension utilizes multiple anti-spam tests to filter spambots with the lowest possible false-positive rate.

By using a multi-layered approach, the system avoids blocking real website visitors even if one specific test fails, ensuring a seamless experience for your users.

Spam attacks log
The CleanTalk service (this hook is a client application for the CleanTalk anti-spam service) records all filtered comments, registrations, and other spam attacks in the "Log of spam attacks."

The data is stored in the log for up to 45 days. By using this log, you can ensure reliable protection for your website and verify that there is no false-positive filtering.

Real-Time Email Address Existence Validation
It is crucial to ensure that users are providing real email addresses. Spambots frequently use fake or non-existent addresses, which can lead to several significant problems for website owners:

• You can never contact them by email,
• The client will never receive any notifications from you (account activation letter, password recovery, email distribution, notifications, etc.),
• If you use email marketing for your clients, then a large number of nonexistent emails in the mailing list may result in your IP address being added to various blacklists of email servers.

CleanTalk will check email addresses for existence in real time.

Blocking disposable & temporary emails
Block fake and suspicious users using disposable and temporary emails to significantly improve your email delivery rates.

Implementing this protection also prevents malicious activity, spambots, and internet trolls from engaging with your site.

Private block lists
Automatically block comments and registrations using your personal block lists for IP and email addresses.

This feature strengthens your protection against manual spam and allows you to block unwanted content from specific users. For advanced control, you can add individual IP addresses or entire IP subnets to your blacklist.

Blocking users by country
Automatically block comments and registrations from specific countries by setting a country-level ban.

This option is highly effective for enhancing security and preventing manual spam. It is particularly useful if your website is not intended for an international audience and you do not expect legitimate users or comments from outside your target regions.

Blocking comments by "stop words"
You can block comments that contain "stop words" to enhance your spam filtering and automatically block messages containing obscene language.

Lots of features. I have signed us up for a year.

In addition I have signed us up with their Security Service which is a firewall for our forum software. It detects and protects from a lot of things. Got a one year subscription with that as well.

Once I feel comfortable with that I will remove the country blocks from the main firewall which should slightly improve the speed of things site wide.

A with any other firewall there may be issues for some folks as I work to configure things. So if you see a problem please report it here so I can fix things.

 

[Scott Greczkowski]

Any way you can force bots to click on ads?

Well since we have no ads the answer is no. But would be cool if we could. (although I am sure that would be a violation of the Ad Agencies terms of use)

 

[harshness]

Would CrowdSec help?

It is a web equivalent to implementing e-mail spam blocklists, offering free community-generated blocklists as well as subscription blocklists.

Fail2ban is great, but it relies on having already been attacked.

 

[Scott Greczkowski]

Would CrowdSec help?

It is a web equivalent to implementing e-mail spam blocklists, offering free community-generated blocklists as well as subscription blocklists.

Fail2ban is great, but it relies on having already been attacked.

We have some of those things in place. I am trying to figure out what they are doing or trying to do.

Right now I am seeing about 75 connections from different IP addresses at host.colocrossing.com all hitting the server at the same time. Trying to figure out what they are doing.

But if you read the link I posted above from Xenforo, seems many Xenforo forum sites like ours are having this issue currently.

 

[telstar_1]

Looks like effectively some kind of DDOS barrage. But what could be the purpose?

 

[Scott Greczkowski]

Looks like effectively some kind of DDOS barrage. But what could be the purpose?

Not sure and again lots of Xenforo admins are reporting the same thing. I am not getting any alerts of anyone trying to hack into anything. So its odd.

 

[telstar_1]

It just looks like a lot of login spamming from all over, but to what ends?

 

[navychop]

Practice. Maybe an exam for hackers.

 

[Scott Greczkowski]

Actually may have some answers now...

over at Xenforo AndyB sent me a util to tell me what they are... and the majority of them are... GHATGPT. Using 720 connections currently...

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)

Then Google Bot is next using 448 connections at Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.7559.132 Mobile Safari/537.36 (compatible; GoogleOther)

So that's almost 1,200 of the 2,113 guests that are online now. And I am seeing other bots as well but not on such a large scale such as AppleBot, Facebook Crawler, BingBot and others.

 

[Scott Greczkowski]

Here is what I am seeing now.


View: https://youtu.be/6IWqaH2kIoc?si=UoyT3XbjURvXEsjw