Forum issues

[TD-er]

As some of you may have noticed, since the start of 2025, our forum has experienced some issues.

Those were almost all caused by:

• AI scraper bots
• DDoS attacks
• Spammers

Not sure which of these is more useless to anyone and/or wasting more resources.

These resulted in sometimes over 6 Gbit/sec in traffic and several 100k unique IPs "visiting" our forum.

Needless to say, this is way too much to handle for our forum server and thus lead to the forum being unreachable.

To counter these attacks, we have tried a number of things, which -sadly- may also affect real users:

• Block IP-ranges in the firewall (sadly this also may block regular users)
• Dynamic block 'visitors' which show similar behavior as AI scraper bots and/or spammers
• Add filtering on posts to detect spam. Sadly this also may block valid posts. Please report here when this happens to you too.

Also we have had some issues where activation mails were blocked, so new users could not activate their account.
Please report if this happens to you too.

I really hope we now have this a bit more managable.
For example those AI scraper bots are programmed so incredibly unintelligently, causing them to add new bots continuously resulting in 100k+ bot IP-addresses to try and scrape the forum content causing 100's of GBytes of traffic and unbearable high CPU load of the forum server.

Also for some reason unknown to us, we have been hit by several DDoS attacks, where they use spoofed IP-addresses to simulate requests from 100k+ unique IPs.
Not only did they use spoofed IP-addresses, but also regular customers from various ISPs who likely have their PC infected with some malware.
This last group of malware infected PCs was mainly coming from South American countries. So that's the reason why -sadly- also real users may be IP-blocked from within those countries.

[chromoxdor]

It is happening again. 😳
@TD-er thanks for taking care every time. That must be super annoying and frustrating.
If there is something one can do, please let us know.

[TD-er]

Yep we had another attack this morning.
Took again another 2 hours to track down the IPs of the attack (which were only a handful this time)
I'm sooo done with those low-life types trying to hack the server.
This time it were hack scripts being run to try and find some exploits.

[TD-er]

And another AI botnet was 'crawling' using roughly 80'000 unique IPs.

[chromoxdor]

I am having problems with posting in the forum. Not sure what’s causing it.

Edit: I can not post Javascript somehow.. so i had to remove it. 🤷‍♂️

[tonhuisman]

There is some more strict page validation before a page is accepted. JS obviously isn't accepted...

[TD-er]

Yep, that's the Apache ModSecurity plugin.
I've been hit with the same message myself.
However it does also keep spammers out quite well. I only hope it doesn't keep legitimate users away from registration and/or posting.

[TD-er]

Forum is again under some kind of attack.
Server was already restarted as we've completely ran out of memory due to excessive queries.
Within 5 minutes after reboot the server was unreachable again.

[TD-er]

And the attack seems to have intensified... the forum server is already overloaded again within 1 minute after reboot.

[TD-er]

No idea why but apparently there are some addresses in 74.7.227.x used for IP-spoofing, as traces to it hop all over the world. However these were responsible for way over 1 million requests in bursts on Saturday.

[TD-er]

And the forum is unreachable again.
Roughly a week since the last 'attack' by those really dumb programmed AI scraper bots.

I really really loathe those AI scraper bots, as they literally attack sites with 1000's and 1000's of bots at the same time, each fetching only 1 or 2 URLs periodically.
Then they try to make money themselves by ripping sites and making them inaccessible for the rest of the world.

[tonhuisman]

Some extra measures have been enabled.

If the forum complains about the certificate being invalid (happened here when using Firefox), try removing any session info from the url, so if this is the old url: https://letscontrolit.com/forum/index.php?sid=334a33...(blurb),
change that to https://letscontrolit.com/forum and it should be fine.

[TD-er]

I've also noticed sometimes I get a DNS error, which should be 'fixed' after a reload.
If this happens while posting a message, please do a refresh and confirm the browser's question to re-submit or else your typed post will be lost.
If this isn't enough, please try to open the forum in another tab and when this is successful, try to re-submit your post.

Remco is looking into this issue with DNS.

[TD-er]

As you may have seen by the error pages shown by Cloudflare, the site is again unreachable due to AI crawlers, which are not stopped by Cloudflare. Even after a server reboot, the server is again within 1 minute completely unreachable due to the many requests made by AI bots.

I really HATE those AI bots!

And the metrics about where all is coming from, is from Cloudflare as they claim to have saved us about 300 MByte in traffic... well in the mean time those AI bots took 30+ GByte in traffic.

So call me cynical, but I'm not very impressed by the AI bot filtering I was hoping Cloudflare would do.

I would like to consider ESPEasy to be popular, but I doubt there are over 13k users franticly pressing F5 to read the latest forum posts.

And just like before, each 'unique visitor' fetches only a few pages, but they do it all at once.

There are not even 300k different pages on our forum, just showing how incredible stupid and waste of resources those AI scraper bots are.

I am so sick and tired of all of these energy wasting, resource wasting and time consuming bots!

[chromoxdor]

I would like to consider ESPEasy to be popular, but I doubt there are over 13k users franticly pressing F5 to read the latest forum posts.

I was hitting F5 a few times ;)
But I am wondering the whole time what makes ESPEasy so special as a target. I’ve never experienced something similar in the other forums that I use.

I am so sick and tired of all of these energy wasting, resource wasting and time consuming bots!

Sorry to hear that and I totally understand your frustration.