Why there are so many guest visiting our forum ?

[Dimitris GR]

Randowe had problems to post, I just type this for test

[none]

Randowe had problems to post, I just type this for test

If you're testing, it does work now, but earlier (around 12h UTC) the forum was down (SQL error: Too many connections) for a while.

I don't know what's going on, but there are a huge lot of "guests" lurking around lately (51 right now), that's a lot. Usually you've got 3-4...

[Dimitris GR]

I had the same problem before 1 hour. Now is ok again

[randowe]

I constantly see between 400 and 500 guests online and the record of 631 is also from today. Often i get error message and have to load the forum 10 times.

[none]

I constantly see between 400 and 500 guests online

Ah yes, I forgot to mention those 51 were specifically in this forum part...
Right now it says 514 "guests" in the forum root, and that's very curious. Dare I say "suspicious"? I've (co-)run a hobbyist forum for over 10 years as admin, with a larger fan base and lots of regulars, and we only had an average of 30-50 "guests" at any time, usually people who had landed there without knowing where they were going, or those people who routinely delete their cookies and thus when arriving appear as "guest" until they logged back in (like me - Each time I arrive a create for 5 minutes a "guest" phantom before appearing as "none").

What are those 504 guests doing? As a simple user I can't see, Luis who is an admin should check them. A part of those will be "lurkers", people interested by OG, but not enough to register and post, but this is the Internet, so who/what are the others, and why are they sticking around?...

[randowe]

I don't think these 500 guests are humans. Likely 500 bots....

[Parabellum]

I have a general problem accessing the forum: The forum cannot be displayed. A pop-up window appears with the message

SQL ERROR [ mysqli ]

Too many connections [1040]

An sql error occurred while fetching this page. Please contact an administrator if this problem persists.

If the access was successful after many attempts, the problem occurred again when submitting the posts. Written texts are then lost and have to be rewritten.
I experienced this problem on both PCs that I use (Home, Office). They are at different addresses.

Does anyone else have these problems and how can they be solved?

[hoza]

none and others, me too. We suspect overload by bots.

[Parabellum]

none and others, me too. We suspect overload by bots.

Thanks for the tip. I hadn't even registered that yet. Currently over 500 users, last night over 800.

[none]

Possibly, but all the legitimate/official bots (like search engine crawlers etc.) have names (user agents), and show up as whatever they are. For instance right now there are me, "Bing [Bot]", and 502 guests on the forum...

[none]

Indeed, there has been a discussion over there (BTW, could somebody with moderator powers separate those discussions into their own thread? I'm afraid this discussion isn't finished yet, and in the meanwhile it's polluting...).


That been said, I'm wondering what those 500+ "guests" are looking for. I mean, I can understand a dozen bots and/or tourists having randomly stumbled upon this forum and sifting through the contents, but why on earth over 500 at any time (and increasing)???
This is almost a distributed denial of service (DDoS)...
The only way to know for sure what they do and, most importantly, where they come from, would be by checking the server logs, where you can see all connections, where each connection came from (geolocated IP) and what they are supposed to be (how they present themselves).

[LuisGuzman]

I tried to look into this issues but could not find how to avoid, so I've asked Csava to have a look as he is much much better than me on this affairs.

I hope he can find any solution this evening after he finish working,

I've opened this topic and moved all related post here, to avoid spreading other topics with comments related this issue.
this can be fixed soon.

[none]

There is no really easy way to "fix" this, the only solution phpBB offers is to ban a range of IP addresses (like "1.0.0.1" to "1.0.0.255"), if (and only if!) all those "guests" come from a specific homogeneous IP range, and aren't just hacked residential IPs from all over the world.
Else you can only try to weather the storm, after having made sure they aren't doing anything nasty (like, forum has been hacked and serves as command & control server for some malware out there, or some such...).

They are doing something, because sometimes the forum is fluid like before despite the number of "guests", and sometimes it's slow as molasses (or even craps out with that famous SQL error).
It is quite possible they are "just" doing some "credential stuffing" to get into an admin account (i.e. trying all known/weak passwords till they find the right one). Trying a dozen logins/second can bring the SQL server on its knees, and since after a number of failed attempts your IP is banned for a while, they immediately switch to another IP address, and so register as many, different users.
In which case the 500-800 guests we see aren't simultaneously here, they are 500-800 successive individual connections from the last 5 minutes (phpBB keeps the memory of a connection for 5 minutes).

[sympatyk]

It's similar on our server - there are periodic difficulties in accessing the forum... the number of 130 guests is a lot (usually 20-40)
Maybe there was information about a game somewhere in the media (even one related to the name "general")?

[none]

Maybe there was information about a game somewhere in the media (even one related to the name "general")?

I don't think so.
If there really had been some major buzz around OG, big enough to attract all of a sudden a thousand potentially interested people (!), some (even only 1-2%) of those thousands of "guests" would had registered and posted by now. We would had heard about it.

Besides, people interested by OG would go straight for the downloads, they certainly won't lurk in the forums for days... OG is a game, not a discussion point, you can enjoy it fully without ever visiting the forums.

Normally most players wouldn't even visit the forums unless they have a problem, in which case they would register to ask their questions.

I think those are bots, from some ongoing malware campaign. As I said earlier (further up?), I've administered a phpBB forum for a friend for over a dozen years, and I've seen them coming and going... Like a storm on sea, all we can do is make sure they don't sink our little ship (meaning, they don't manage to grab/guess some credentials allowing them to take control of the server).

[randowe]

Only 20 users online! Did you guys solve the issue?
EDIT: I celebrated too soon. The next minute there are 504

[none]

EDIT: I celebrated too soon. The next minute there are 504

That does indeed confirm my suspicion that those are not individual humans but successive bot connections: There is no way you can organize 484 people to arrive all simultaneously on the forum and suddenly rise the number of connected users from 20 to 504...

But given phpBB's "Who is online" feature lists users active during the last 5 minutes, one single bot trying to connect a 100 times/minute will indeed show as (more or less, depending on lag) 500 users...

The reassuring thing is that after so many days (that would be about 144k attempts/day) it still hasn't managed to do whatever it tries to do.

[Dimitris GR]

The forum is too slow.....

[none]

Thanks to those bots hammering it...

[Dimitris GR]

Now i had no problems at all. Depends the hour i guess (513 guests), so is not the number of guest i think.

[none]

Seems the flood is receding: When I last posted (above) there were only around 200 "guests" here, and now there are only 101 left. Good riddance!

[hoza]

Bing [Bot], hoza and 6 guests

[none]

Bing [Bot], none, and 65 guests.

The flood is receding, but still not gone.
As for the Bing Bot, it must have an apartment here, because I see it every time I visit...

[LuisGuzman]

Bing [Bot], none, and 65 guests.

The flood is receding, but still not gone.
As for the Bing Bot, it must have an apartment here, because I see it every time I visit...

Is your default web explorer Bing perhaps ?
I don't see Bing but Google [Bot]

[randowe]

There are 3 bots often online on this site. Bing, Google and another one (i don't remember). While they are online often, they are not online all the time.
EDIT: Majestic-12 [Bot] it is.

[none]

Is your default web explorer Bing perhaps ?

No, of course not!
My browser is Firefox and my default search engine is DuckDuckGo.

I do see the Google bot too, sometimes, but the Bing bot is a regular. IMHO this could have something to do with the hours I'm visiting here. And the time Bing bot spends on the forum (you're sure there isn't a bar hidden somewhere?... )

To get back on topic:
Bing [Bot], Google [Bot], none, and 32 guests. Seems the storm is over.