Slow forum access times....anyone but me?

[Wiz57]

@rockedge
I still see occasional slowdowns and "too many requests", I'm also still seeing Rise IP Addresses in the "Guests"...
the IP Addresses start with 152.53.XXX.XXX, where the 3rd and 4th sets are various for IPV4 addressing.
Can we block them?

[N97]

The IP listed as 152.53.x.y belongs to ANEXIA.COM. Specifically, the AUSTRIA location. The link will also show 3 other nodes... 2 in USA on E. Coast. One in NY, and one local to Wash. DC.

[keniv]

Just got the "To many requests" notice for the first time just now here in the UK. Every page takes 30 secs or more to open making the forum difficult to use. Thought it worth reporting again. Will try again later.

Ken.

[keniv]

Forum still a little slow for me this morning but not as bad as it was last night. No "To many requests" message now.

Ken.

[mikewalsh]

Once again, back to "429 : Too many requests" and 30+ second access times. Getting annoying.

Mike.

[hikohan]

Suggest limit max connections per IP, monitor user connection, site bandwidth * system performance if under `DDoS` crawler attack.

Same issue attached.

[rockedge]

Suggest limit max connections per IP, monitor user connection, site bandwidth * system performance if under `DDoS` crawler attack

All being done and monitored.

This is the top offender:

Robots/Spiders	Hits	Bandwidth	Last visit
Robots/Spiders Unknown robot identified by bot\*	Hits 3,270,193+3857	Bandwidth 61.26 GB	Last visit 25 Feb 2025 - 05:03
Robots/Spiders crawl	Hits 807,694+52	Bandwidth 76.83 GB	Last visit 25 Feb 2025 - 05:00

[bigpup]

At this time of slowness.

Noticed these are accessing: Bing [Bot], DuckDuckGo [Bot], Google [Bot]

[d-pupp]

It's 2:35 Eastern time. A few minutes ago I couldn't access the site at all. When I did get in after 4 attempts it was very slow and then I go booted out.
Seems like some kinda denial of service attack??

[rockedge]

I flushed all the registered user current logins and cleared the cache. Fixed it a bit by throwing off the bots that can access by robot bot logins

So if one might have been logged off after the actions.

[Wiz57]

At this time of slowness.

Noticed these are accessing: Bing [Bot], DuckDuckGo [Bot], Google [Bot]

Those are almost always on, as they update their search cache. IF you really want to see who the culprits really are,
Click the link "WHO IS ONLINE" close to the bottom of the Forum index page...it will show everyone currently on the
forum, unless they choose to be "hidden"...now for the fun part, click on "Display guests"...ah hah! Look at all the guests!
Notice the IP Addresses...many will have the same first two sets of 3 IPV4 numbers, but different last two. Choose a few
of those, and click on"Whois" to the right of their IP Address. This gives you the responsible party for those IP Addresses,
which is why I wondered if we could block those type of "Guests" via robots.txt, just block entire blocks of IP Addresses
especially from RIPE! RIPE seems to be the worst offender.

[hikohan]

If web server based on Apache, add user agent block

Code: Select all

### proxy attack
RewriteCond %{HTTP_USER_AGENT} ^(-|Abcd|AdsTxt|ApiTool|Baiduspider|bidswitchbot|coccocbot|Go|Hikvision|Mozila|Mozlila) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^(Netcraft|node|NoIr|OpenVAS|PycURL|python|scalaj|TprAds|ZmEu) [NC]
RewriteRule .* - [F,L]

And work with fail2ban monitor access_log/error_log may prevent crawler and DDoS attacks.

Suggest limit max connections per IP, monitor user connection, site bandwidth * system performance if under `DDoS` crawler attack

All being done and monitored.

[rockedge]

Seems a a known IP group from Hong Kong is causing us a slow down. I have added to the deny list in the .htaccess file

[backi]

Slow again for me here in Germany ........just want to report!

[pp4mnklinux]

Just in case: Google Page Speed Insights for forum easyos.-

https://pagespeed.web.dev/analysis/http ... tor=mobile

https://pagespeed.web.dev/analysis/http ... or=desktop

[fredx181]

@rockedge
Sure there are problems slowing down the forum access from time to time, but for your sake of of being not to much stressed about it, I'd like to say that, in general, most of the time it's ok from what I experienced.
I think we have to learn just to have some patience sometimes which is a good thing these days IMO (probably some of us are spoiled too much by getting used to the instant access of web pages )

[IdfbAn]

Now it's really slow for me, too!

[mikewalsh]

@fredx181

Doing a "Who is online" check a few minutes ago, there appear to be around 140 users, all from the same IP domain, and all apparently reading or looking through every section of the forum simultaneously!

"Who is" then resolves these all to the Amsterdam area. Not necessarily suspicious.....but definitely highly coincidental. Any thoughts, Fred? No accusations - don't think that! - but these all seem to be from your neck of the woods. What d'ya reckon?

Mike.

[fredx181]

Doing a "Who is online" check a few minutes ago, there appear to be around 140 users, all from the Amsterdam area, and all apparently reading or looking through every section of the forum simultaneously!

Not necessarily suspicious.....but definitely highly coincidental. Any thoughts, @fredx181?

Mike.

No thoughts I have about that, yes I'm from the Amsterdam area but as far as I know I'm not guilty of doing anything weird

[mikewalsh]

@fredx181 :-

The only thing I can think of - I've no idea if it's possible (probably is) - is that somebody's "piggy-backing" onto the IP of a forum regular..? God above knows why, but folks do some weird shit these days, and all for reasons best known to themselves.

We can only hope that they eventually get tired of their little game, and bugger off to harass somebody else!

EDIT:-

Whoah! First time I've seen a "Too many requests" IMMEDIATELY followed by a "404 : Not found" error... WTF?!??

Mike.

[pp4mnklinux]

@rockedge
Sure there are problems slowing down the forum access from time to time, but for your sake of of being not to much stressed about it, I'd like to say that, in general, most of the time it's ok from what I experienced.
I think we have to learn just to have some patience sometimes which is a good thing these days IMO (probably some of us are spoiled too much by getting used to the instant access of web pages )

Different oppinion here:

@rockedge, I think puppylinux must be very stressed about it.
PuppyLinux is not a top distribution with many followers or users. It is hard to attract new users, and if, when they do arrive, they land on a page that takes too long to load, they will simply forget about their interest in the distro.

A SEO can spend hundreds of hours attracting new users to their business, they may have many clients, and provide great service... but people soon forget all of this.

As of today, I’m the first one to admit, when a page takes more than 3 seconds to load, I simply close it and move on to something else.

It is my oppinion, of course, so consider it as it.

HAVE A NICE DAY.

[IdfbAn]

As of today, I’m the first one to admit, when a page takes more than 3 seconds to load, I simply close it and move on to something else.

Yep. I guess we've all just been spoiled by broadband and fiber, but at the same time, I think it's best we leave those dial-up speeds well into the past. Let's not bring back that hell, please.

[fredx181]

@rockedge
Sure there are problems slowing down the forum access from time to time, but for your sake of of being not to much stressed about it, I'd like to say that, in general, most of the time it's ok from what I experienced.
I think we have to learn just to have some patience sometimes which is a good thing these days IMO (probably some of us are spoiled too much by getting used to the instant access of web pages )

Different oppinion here:
...
.... when a page takes more than 3 seconds to load, I simply close it and move on to something else
...

C'mon, you don't want to wait a little more than 3 seconds ??!! That's exaggerated !

[pp4mnklinux]

@rockedge
Sure there are problems slowing down the forum access from time to time, but for your sake of of being not to much stressed about it, I'd like to say that, in general, most of the time it's ok from what I experienced.
I think we have to learn just to have some patience sometimes which is a good thing these days IMO (probably some of us are spoiled too much by getting used to the instant access of web pages )

Different oppinion here:
...
.... when a page takes more than 3 seconds to load, I simply close it and move on to something else
...

C'mon, you don't want to wait a little more than 3 seconds ??!! That's exaggerated !

EXAGGERATED??? don't think so,

https://red-website-design.co.uk/why-yo ... 3-seconds/

[fredx181]

Different oppinion here:
...
.... when a page takes more than 3 seconds to load, I simply close it and move on to something else
...

C'mon, you don't want to wait a little more than 3 seconds ??!! That's exaggerated !

EXAGGERATED??? don't think so,

Okay, fine, for you it isn't, but just my point of view, that's what I meant saying earlier that people got spoiled by the extreme fast internet access these days, think of 5G ...

EDIT: But this is bad of course, as @mikewalsh wrote:

EDIT:-

Whoah! First time I've seen a "Too many requests" IMMEDIATELY followed by a "404 : Not found" error... WTF?!??

[rockedge]

I am doing what is possible including hounding the tech staff at the host provider. This is a shared server and not VPS so no direct control of iptables.

There are several different protections in operation and I have denied any access to a range of IP's but not helping much right now.

I do have a trick that would take the forum off line and only provide one single error page of emptiness that will break the cycle. But that's a most unfavorable tactic for us as it is blocking us all from interacting with the forum.

Looking at all the pathways right now......

[mikewalsh]

I am doing what is possible...

We're 100% certain you're doing whatever you can, Erik.....and it is, as always, very much appreciated. Never think otherwise.

I do have a trick that would take the forum off line and only provide one single error page of emptiness that will break the cycle. But that's a most unfavorable tactic for us as it is blocking us all from interacting with the forum.

Ouch. Sounds drastic....but perhaps "drastic" is called for..? NO idea.

Let's hope it doesn't come to that...

Mike.

[Chelsea80]

@rockedge

The only thing I am experiencing is an extremely slow speed -

No 'too many requests' - No '404' - No 'not found'.

I do have a trick that would take the forum off line and only provide one single error page of emptiness that will break the cycle. But that's a most unfavorable tactic for us as it is blocking us all from interacting with the forum.

Wouldn't it be worth that short inconvenience for a short time instead of this very annoying long time ?

[Jasper]

[Wiz57]

Add anything registered to RIPE to the htaccess deny list...I'll start by pasting in whois info on IP Addresses/ranges, @rockedge
can take it from there.
NetRange: 152.53.0.0 - 152.53.255.255
CIDR: 152.53.0.0/16
NetName: RIPE
NetHandle: NET-152-53-0-0-1
Parent: NET152 (NET-152-0-0-0-0)
NetType: Early Registrations, Transferred to RIPE NCC
OriginAS:
Organization: RIPE Network Coordination Centre (RIPE)
RegDate: 2023-02-14
Updated: 2025-02-10
Comment: These addresses have been further assigned to users in the RIPE NCC region. Please note that the organization and point of contact details listed below are those of the RIPE NCC not the current address holder. ** You can find user contact information for the current address holder in the RIPE
database at http://www.ripe.net/whois.
Ref: https://rdap.arin.net/registry/ip/152.53.0.0
______________________________________________________________________________
NetRange: 188.0.0.0 - 188.255.255.255
CIDR: 188.0.0.0/8
NetName: 188-RIPE
NetHandle: NET-188-0-0-0-1
Parent: ()
NetType: Allocated to RIPE NCC
OriginAS:
Organization: RIPE Network Coordination Centre (RIPE)
RegDate:
Updated: 2025-02-10
Comment: These addresses have been further assigned to users in the RIPE NCC region. Please note that the organization and point of contact details listed below are those of the RIPE NCC not the current address holder. ** You can find user contact information for the current address holder in the RIPE database at http://www.ripe.net/whois.
Ref: https://rdap.arin.net/registry/ip/188.0.0.0

ResourceLink: https://apps.db.ripe.net/db-web-ui/query
ResourceLink: whois.ripe.net
___________________________________________________________________________________

NetRange: 57.0.0.0 - 57.255.255.255
CIDR: 57.0.0.0/8
NetName: RIPE-ERX-57
NetHandle: NET-57-0-0-0-1
Parent: ()
NetType: Early Registrations, Maintained by RIPE NCC
OriginAS:
Organization: RIPE Network Coordination Centre (RIPE)
RegDate: 1993-06-21
Updated: 2025-02-10
Comment: These addresses have been further assigned to users in the RIPE NCC region. Please note that the organization and point of contact details listed below are those of the RIPE NCC not the current address holder. ** You can find user contact information for the current address holder in the RIPE database at http://www.ripe.net/whois.
Ref: https://rdap.arin.net/registry/ip/57.0.0.0

ResourceLink: https://apps.db.ripe.net/db-web-ui/query
ResourceLink: whois.ripe.net
_____________________________________________________________________________________

NetRange: 185.0.0.0 - 185.255.255.255
CIDR: 185.0.0.0/8
NetName: RIPE-185
NetHandle: NET-185-0-0-0-1
Parent: ()
NetType: Allocated to RIPE NCC
OriginAS:
Organization: RIPE Network Coordination Centre (RIPE)
RegDate: 2011-01-04
Updated: 2025-02-10
Comment: These addresses have been further assigned to users in the RIPE NCC region. Please note that the organization and point of contact details listed below are those of the RIPE NCC not the current address holder. ** You can find user contact information for the current address holder in the RIPE database at http://www.ripe.net/whois.
Ref: https://rdap.arin.net/registry/ip/185.0.0.0

ResourceLink: https://apps.db.ripe.net/db-web-ui/query
ResourceLink: whois.ripe.net

More to come