SHP Forums

I have been aware of this for the past few days. It was affecting the other database driven parts of the website. It took awhile to determine that it is targeted at the forums since I had been working fairly intensively on the Wiki and didn't know if that was putting too much of a load on the database server or not. Don't know if it is spambots attacking the forum's registration or what. If I can find IPs that are attacking I could add add a block of IPs in that range. I did notice a overly large usage from Brazil of all places, which is odd. I don't want to block the entire country based on such thin evidence.

I just disabled forum registration to see if that helps. So for now this will have to be manual registration by admin until it gets sorted out. In the meantime, people can request an account on the Facebook group or contracting Tawmis or me.

Seems to be working much better now. Thank you.

Yeah - I noticed this:

Most users ever online was 14367 on Mon Mar 17, 2025 10:42 pm

Something strange I just noticed: the forum will only let people login and logout, i.e. it's impossible for someone to register as a new user.

Is this right? I don't think I've seen that before. What happened?

notbobsmith wrote: ↑Mon Mar 17, 2025 11:58 pm Has anyone else been having problems viewing the forums the last couple of days. I get an error 429: "429 Too Many Requests
The user has sent too many requests in a given amount of time."

Looking at the "Who is online" at the bottom of the page it says:

In total there are 1073 users online :: 1 registered, 0 hidden and 1072 guests (based on users active over the past 5 minutes)
Most users ever online was 11171 on Mon Mar 17, 2025 4:50 am


I'm guessing that's not normal.

Yes, I also got it.

I assume this also answers my question (above)? Were we "visited" by a huge bunch of bots that temporarily brought the forum down?

Just wondering. Thanks!

The entire forum disappeared earlier today. Glad to see it is back!

If I could find the IPs of those that are causing it I could block them.

as admin I think viewonline.php?sg=1 could show the ips ?

Rath Darkblade wrote: ↑Thu Mar 20, 2025 2:44 am Something strange I just noticed: the forum will only let people login and logout, i.e. it's impossible for someone to register as a new user.

Ahem - scroll a few posts up - viewtopic.php?p=102833#p102833

Qbix wrote: ↑Thu Mar 20, 2025 6:55 pm as admin I think viewonline.php?sg=1 could show the ips ?

Yeah, but sorting through legitimate users from ones that are causing the problem is another matter.

Tawmis wrote: ↑Thu Mar 20, 2025 7:07 pm

Rath Darkblade wrote: ↑Thu Mar 20, 2025 2:44 am Something strange I just noticed: the forum will only let people login and logout, i.e. it's impossible for someone to register as a new user.

Ahem - scroll a few posts up - viewtopic.php?p=102833#p102833

Yes, I understood that. I was just wondering if those "guests" are bots of some kind, as Collector seems to suspect. That would explain what's happening to the forum.

Collector wrote: ↑Fri Mar 21, 2025 6:03 am

Qbix wrote: ↑Thu Mar 20, 2025 6:55 pm as admin I think viewonline.php?sg=1 could show the ips ?

Yeah, but sorting through legitimate users from ones that are causing the problem is another matter.

I say we nuclear option and anyone who hasn't validated/posted here in 3 months, we nuke their account. Because an account isn't needed to read the forums. If all they're doing is reading threads and getting help, then no account is needed. If they're going to engage, you'd think they'd do it within 3 months of registering.

Qbix wrote: ↑Thu Mar 20, 2025 6:55 pm as admin I think viewonline.php?sg=1 could show the ips ?

true, but there might be a common ip or browser id ( like some weird bot). I every now and then add new bots types to the vogons forum. Not sure if it really helps, but at least they show up more nicely in the active userlist then.

Still it must be a headache to deal with for you.
Hope that whatever caused it, has moved on (or you fixed it)

I looked for a range of IPs that seemed to occur in disproportionate numbers, but did not find anything like I used to be able to do. I found a large number of ones from Brazil of all places. There were a lot of pending posts, all in Russian I suspect that the guilty party has been spoofing IPs.

Brazil is always high in the list of ips who try random logins on my personal server. Not sure why, but it does match with your findings.
Given that they want post a reply (which they can't) does make it feel like it is some sort of bot/automated script).

I was assuming such. Registrations are still disabled and will remain so for the time being, so they can't be spamming the CAPTCHA. I'd really rather not block the entire Brazil IP blocks.