Semi-attacks

[Kip]

Hey guys...

For the past 2 days, we've been bombarded by a weird Ukrainian SEO company's crawler(s). They apparently have thousands of subdomains set up carrying this stupid thing, and are known to pelt sites with a heavy resource load (it's been OK so far, but could potentially slow us down). The biggest issue is they're skewing our statistics radically, driving up bounce rates, etc. They're also prone to obfuscate their actual purpose as well. They declare they're an SEO improvement group building some kind of new search engine....but I believe they're actually a marketing group trying to build a 1990's era referral network (A method that hasn't worked for years. Idiots.). In any event, I've had trouble blocking them by IP (they either have thousands of those too, or are masking their true IP) and by domain/subdomain (too many to block). I have edited our .htaccess to try and block them wholesale. We'll see what happens. I'm not an IT guy, so it's entirely likely I could screw something up. Seems to be working at the moment, though.

All this to say: Please report any website weirdness to the proprietors so I can fix it.

[Stewmuse]

I've been trying upload pictures of Craig screaming with a look of horror on his face as he frantically tries to outswim a small turtle, but I keep getting an error message. It says "bugger off, butt munch." Should this be happening?

[CigarSpurs]

Kip-
Today is the first day when I hit view new posts, it comes back and says Busy. Try again later.
Or something like that. I can click on the room to get to it and after hitting new posts a couple
times, it does work.
No biggy, but since you were asking.....

[Kip]

Kip-
Today is the first day when I hit view new posts, it comes back and says Busy. Try again later.
Or something like that. I can click on the room to get to it and after hitting new posts a couple
times, it does work.
No biggy, but since you were asking.....

Yep. That's what clued me in that something was going on originally. When the one-minute server load is greater than 1 (which means we are over-running the processor; 1=100%), the search function shuts off for the forum. The search is what builds the "Unread Posts" when we click that link. This search takes a significant but manageable amount of "oomph" to run. That should clear up shortly.

[CigarSpurs]

.......and I just clicked on it and got this thread, so it isn't all the time.

[Kip]

.......and I just clicked on it and got this thread, so it isn't all the time.

Yeah, I've been messing with intermittently since about 2:30pm EST yesterday. Trying different ways to cut them off.

[CigarSpurs]

FYI Kip. No biggie. Got it 3X before connecting'
"Sorry but you cannot use search at this time. Please try again in a few minutes."

[Kip]

FYI Kip. No biggie. Got it 3X before connecting'
"Sorry but you cannot use search at this time. Please try again in a few minutes."

Thanks. We'll still see if intermittently when we legitimately have several people trying to use the search within the set timeframe. As the database behind the forum gets bigger, it takes a great deal of processor work to search it (every "Unread Posts" click = a search, as does several other functions). If the requirements go over 100% for more than a minute, it shuts down search capability for 60 seconds or so. I've cut out the ability of bots and unregistered guests to use the search functions, which should cut down on the frequency you see that message....but it will still pop up on occasion.

This message can also be triggered if we have a steep bump in traffic on the blog - both blog and forum are tied to the same processor. Let me know if it persists and gets too bothersome. I might be able to up the limit so it isn't cut back so often.

[Kip]

I've had our host provider run a 5 day log to find out what has been causing the server straing (the reason we sometimes can't use the search function, as explained earlier). Turns out we've been experiencing regular brute force attacks from a couple of different IP addresses - one in China, and one from Spain. I am going to have those two addresses shut off from accessing the site. If any of you happen to have IP blockers in place that might appear to be coming from Spain or China, now would be a good time to speak up

[Kip]

OK, I've blocked the two main offenders (although they'll probably hijack another IP or two in the near future). I also took the opportunity to declutter and optimize the DB tables for the main site. It should be smoother and maybe a little quicker in operation. I'll do the forum DB sometime this week....