Yesterday was invasion of the bots

Post by **matthew1** » 01 Oct 2025, 12:16

Heinous attack the last 24 hours by bots, but not the usual spam bots... kinda like a DDoS. But Cloudflare didn't see it as such, so I don't know what to call it. Very similar to the usual junk I've been seeing for about a year, but much more intense.

No increased spam bot registration on the forum, that's why I know it's not that. Knocked us right off the Web. I had to use "I'm under attack" mode on and off. Found the offending IPs and banned them, and huge ranges too when I found IPs on same subnet.

Cloudflare's ASNUM blocking simply does not work, I've found. Flat broken. I've experienced this four or so times. I've set the block, then 24 hours later I dig in logs and there are several IPs from the ASNUM pounding away at my CPU cycles. I'm done with CF's ASNUM.

Here's a graph of the last 24 hours. The line is # requests fielded by MVS server. The dips in between the peaks are when I set CF to "I'm under attack" which puts that interstitial page up where you have to click the box to prove you're human.

The lower more or less horizontal part of the line is normal traffic. Those peaks are the bots hitting the server doing junk requests or harvesting for AI machine learning. The server is just not built to serve 1.5M+ requests/day. I can't cache the forum, so every page request hits the database.

This morning I did ~10 huge /24 and /16 IP range blocks, then deactivated I'm Under Attack. That was at 8:30 am, and you can see in the graph where that happened and a bit more traffic came through.

Post by **matthew1** » 01 Oct 2025, 13:24

Just so we're clear: this is not "hacking" and your data is not in danger. This is just automated traffic from one server to another (MVS), repeated. Nothing in our accounts holds credit card info, or home addresses, or even phone numbers anyway.

Post by **volvolugnut** » 01 Oct 2025, 15:18

Thanks for coping, fixing, and explaining.
volvolugnut

Post by **matthew1** » 01 Oct 2025, 16:35

I hope I explained it ok.

I learned some new tricks in the last 24 hours to combat this scourge.

Post by **matthew1** » 04 Oct 2025, 09:28

And just like that they turn their attention to lower hanging fruit. This graph is attack mitigation, or rather, traffic from any source I block.

This proves the data harvesting is a single actor.

The Internet is a big, dark, weird place and don't let anyone tell you it's not.