Hey guys...
For the past 2 days, we've been bombarded by a weird Ukrainian SEO company's crawler(s). They apparently have thousands of subdomains set up carrying this stupid thing, and are known to pelt sites with a heavy resource load (it's been OK so far, but could potentially slow us down). The biggest issue is they're skewing our statistics radically, driving up bounce rates, etc. They're also prone to obfuscate their actual purpose as well. They declare they're an SEO improvement group building some kind of new search engine....but I believe they're actually a marketing group trying to build a 1990's era referral network (A method that hasn't worked for years. Idiots.). In any event, I've had trouble blocking them by IP (they either have thousands of those too, or are masking their true IP) and by domain/subdomain (too many to block). I have edited our .htaccess to try and block them wholesale. We'll see what happens. I'm not an IT guy, so it's entirely likely I could screw something up. Seems to be working at the moment, though.
All this to say: Please report any website weirdness to the proprietors so I can fix it.
Semi-attacks
- Kip
- International Hillbilly
- Posts: 3204
- Joined: Sun Jan 12, 2014 10:18 pm
- Location: Santiago, Dominican Republic
- Contact:
Semi-attacks
White shores, and beyond, a far green country under a swift sunrise....
- Stewmuse
- Horn Tootin' Torcedor
- Posts: 2973
- Joined: Thu Jul 17, 2014 11:21 pm
- Location: Just a bit NW of Chicago
- Contact:
Re: Semi-attacks
I've been trying upload pictures of Craig screaming with a look of horror on his face as he frantically tries to outswim a small turtle, but I keep getting an error message. It says "bugger off, butt munch." Should this be happening?
StewMuse
Stay smokey, my friends.
Stay smokey, my friends.
- CigarSpurs
- Jingle. Jangle. Jingle.
- Posts: 40
- Joined: Thu Oct 16, 2014 7:52 pm
- Location: Clearwater, FL
Re: Semi-attacks
Kip-
Today is the first day when I hit view new posts, it comes back and says Busy. Try again later.
Or something like that. I can click on the room to get to it and after hitting new posts a couple
times, it does work.
No biggy, but since you were asking.....
Today is the first day when I hit view new posts, it comes back and says Busy. Try again later.
Or something like that. I can click on the room to get to it and after hitting new posts a couple
times, it does work.
No biggy, but since you were asking.....
- Kip
- International Hillbilly
- Posts: 3204
- Joined: Sun Jan 12, 2014 10:18 pm
- Location: Santiago, Dominican Republic
- Contact:
Re: Semi-attacks
Yep. That's what clued me in that something was going on originally. When the one-minute server load is greater than 1 (which means we are over-running the processor; 1=100%), the search function shuts off for the forum. The search is what builds the "Unread Posts" when we click that link. This search takes a significant but manageable amount of "oomph" to run. That should clear up shortly.CigarSpurs wrote:Kip-
Today is the first day when I hit view new posts, it comes back and says Busy. Try again later.
Or something like that. I can click on the room to get to it and after hitting new posts a couple
times, it does work.
No biggy, but since you were asking.....
White shores, and beyond, a far green country under a swift sunrise....
- CigarSpurs
- Jingle. Jangle. Jingle.
- Posts: 40
- Joined: Thu Oct 16, 2014 7:52 pm
- Location: Clearwater, FL
Re: Semi-attacks
.......and I just clicked on it and got this thread, so it isn't all the time.
- Kip
- International Hillbilly
- Posts: 3204
- Joined: Sun Jan 12, 2014 10:18 pm
- Location: Santiago, Dominican Republic
- Contact:
Re: Semi-attacks
Yeah, I've been messing with intermittently since about 2:30pm EST yesterday. Trying different ways to cut them off.CigarSpurs wrote:.......and I just clicked on it and got this thread, so it isn't all the time.
White shores, and beyond, a far green country under a swift sunrise....
- CigarSpurs
- Jingle. Jangle. Jingle.
- Posts: 40
- Joined: Thu Oct 16, 2014 7:52 pm
- Location: Clearwater, FL
Re: Semi-attacks
FYI Kip. No biggie. Got it 3X before connecting'
"Sorry but you cannot use search at this time. Please try again in a few minutes."
"Sorry but you cannot use search at this time. Please try again in a few minutes."
- Kip
- International Hillbilly
- Posts: 3204
- Joined: Sun Jan 12, 2014 10:18 pm
- Location: Santiago, Dominican Republic
- Contact:
Re: Semi-attacks
Thanks. We'll still see if intermittently when we legitimately have several people trying to use the search within the set timeframe. As the database behind the forum gets bigger, it takes a great deal of processor work to search it (every "Unread Posts" click = a search, as does several other functions). If the requirements go over 100% for more than a minute, it shuts down search capability for 60 seconds or so. I've cut out the ability of bots and unregistered guests to use the search functions, which should cut down on the frequency you see that message....but it will still pop up on occasion.CigarSpurs wrote:FYI Kip. No biggie. Got it 3X before connecting'
"Sorry but you cannot use search at this time. Please try again in a few minutes."
This message can also be triggered if we have a steep bump in traffic on the blog - both blog and forum are tied to the same processor. Let me know if it persists and gets too bothersome. I might be able to up the limit so it isn't cut back so often.
White shores, and beyond, a far green country under a swift sunrise....
- Kip
- International Hillbilly
- Posts: 3204
- Joined: Sun Jan 12, 2014 10:18 pm
- Location: Santiago, Dominican Republic
- Contact:
Re: Semi-attacks
I've had our host provider run a 5 day log to find out what has been causing the server straing (the reason we sometimes can't use the search function, as explained earlier). Turns out we've been experiencing regular brute force attacks from a couple of different IP addresses - one in China, and one from Spain. I am going to have those two addresses shut off from accessing the site. If any of you happen to have IP blockers in place that might appear to be coming from Spain or China, now would be a good time to speak up
White shores, and beyond, a far green country under a swift sunrise....
- Kip
- International Hillbilly
- Posts: 3204
- Joined: Sun Jan 12, 2014 10:18 pm
- Location: Santiago, Dominican Republic
- Contact:
Re: Semi-attacks
OK, I've blocked the two main offenders (although they'll probably hijack another IP or two in the near future). I also took the opportunity to declutter and optimize the DB tables for the main site. It should be smoother and maybe a little quicker in operation. I'll do the forum DB sometime this week....
White shores, and beyond, a far green country under a swift sunrise....