Site has gone Dead Slow

[IronNoggin]

What? Are we on Dial Up again??

[caddisguy]

What? Are we on Dial Up again??

Just noticed that myself while I was working on some of the new membership approval.

Logged into the backend and checked the logs. Sure enough found out that we're being flooded by a Chinese botnet (linked to Alibaba)

Blocked them on a firewall level (again)

This has happened before, but once in a while they come back from different IP ranges.

Anyway... it should be better now

[caddisguy]

I'll be around for a bit to keep an eye on things.

Actually just found a list of IP ranges associated with Alibaba so I am going to block add these on the firewall too:

https://networksdb.io/ip-addresses-of/alibaba-cloud-llc

Many are already blocked, but these cockroaches deserve to be fully exterminated

[IronNoggin]

Thanks Caddis. Appreciated.

Appears to be back to normal again now...

[Gateholio]

5:36 pm loads fast now.

[landphil]

Had the same issues earlier today , but it seems to be all good now. Thanks Caddisguy!

[caddisguy]

For any fellow nerds or anyone curious, Alibaba IP addresses hit HBC approximately 164457 within a couple of hours:

# cat huntingbc.ca-ssl_log | awk '{print $1}' | grep -E '^47.' | wc -l
164457

Most of it came from their networks in China, but the amount coming from some of their non-China locations (including the US) was also significant

It appears these bots are being used to crawl websites like ours for their own "free" AI training

Obviously that amount of requests within a short period of time is enough to saturate resources and degrade the performance of most web servers and potentially cost the site money if we go over our bandwidth allocation as a result of serving these requests to them.

Since Alibaba continues to be a shady organization largely controlled by the Chinese government with investors like Mark Carney and Brookfield, I have decided to block the the entire company (about 3 million IP addresses) from our website here and will start making a habit of doing so on all servers that I manage. It is done. All blocked now.

#!/bin/sh
#
# Good riddance to Alibaba and these 3 million or so IP addresses that fall within these ranges

iptables -I INPUT -s 47.74.0.0/16 -j DROP
iptables -I INPUT -s 47.75.0.0/16 -j DROP
iptables -I INPUT -s 47.76.0.0/16 -j DROP
iptables -I INPUT -s 47.77.0.0/16 -j DROP
iptables -I INPUT -s 47.78.0.0/16 -j DROP
iptables -I INPUT -s 47.79.0.0/16 -j DROP
iptables -I INPUT -s 47.80.0.0/16 -j DROP
iptables -I INPUT -s 47.81.0.0/16 -j DROP
iptables -I INPUT -s 47.82.0.0/16 -j DROP
iptables -I INPUT -s 47.83.0.0/16 -j DROP
iptables -I INPUT -s 47.84.0.0/16 -j DROP
iptables -I INPUT -s 47.85.0.0/16 -j DROP
iptables -I INPUT -s 47.86.0.0/16 -j DROP
iptables -I INPUT -s 47.87.0.0/16 -j DROP
iptables -I INPUT -s 47.235.0.0/16 -j DROP
iptables -I INPUT -s 47.236.0.0/16 -j DROP
iptables -I INPUT -s 47.237.0.0/16 -j DROP
iptables -I INPUT -s 47.238.0.0/16 -j DROP
iptables -I INPUT -s 47.239.0.0/16 -j DROP
iptables -I INPUT -s 47.240.0.0/16 -j DROP
iptables -I INPUT -s 47.241.0.0/16 -j DROP
iptables -I INPUT -s 47.242.0.0/16 -j DROP
iptables -I INPUT -s 47.243.0.0/16 -j DROP
iptables -I INPUT -s 47.244.0.0/16 -j DROP
iptables -I INPUT -s 47.245.0.0/16 -j DROP
iptables -I INPUT -s 47.246.0.0/16 -j DROP
iptables -I INPUT -s 47.250.0.0/16 -j DROP
iptables -I INPUT -s 47.251.0.0/16 -j DROP
iptables -I INPUT -s 47.252.0.0/16 -j DROP
iptables -I INPUT -s 47.253.0.0/16 -j DROP
iptables -I INPUT -s 47.254.0.0/16 -j DROP
iptables -I INPUT -s 47.88.0.0/14 -j DROP
iptables -I INPUT -s 47.56.0.0/15 -j DROP
iptables -I INPUT -s 72.254.0.0/16 -j DROP
iptables -I INPUT -s 47.52.0.0/16 -j DROP
iptables -I INPUT -s 61.200.84.0/24 -j DROP
iptables -I INPUT -s 47.89.91.0/24 -j DROP
iptables -I INPUT -s 47.89.112.0/24 -j DROP
iptables -I INPUT -s 111.108.151.176/28 -j DROP

[wideopenthrottle]

awesome...great work

[srupp]

dont understand the jargon or set up however I DO understand smarts and great folks like CADDISGUY his knowledge/smarts/ability..

THANKS MUCHLY.

Steven

[srthomas75]

dont understand the jargon or set up however I DO understand smarts and great folks like CADDISGUY his knowledge/smarts/ability..

THANKS MUCHLY.

Steven

I was going to say something similar. I don't know what most of what caddisguy said means but am appreciative that he does and deals with the issue.