Advertisement:

Author Topic: Tracking failed sign-ups?  (Read 513 times)

Offline MarcoSkoll

  • Newbie
  • *
  • Posts: 6
Tracking failed sign-ups?
« on: February 16, 2020, 10:16:58 PM »
Hello - I run the-conclave.co.uk which uses SMF for our forums. We're currently on 2.0.15, but I'll be updating that shortly (the problem with the 2.0.16 patcher made me put it off and I forgot to get back to it).

We've been having problems with resource limits on our server over the last couple of weeks, which carries with it the potential implication that the server is being targeted.

We're not showing an unusual number of failed log-in attempts, but I'd also like to check the number of failed sign-ups to see if there's a concern there, and I couldn't immediately find a way to do so that didn't involve just turning off our anti-spam measures, turning on admin approval and seeing what happens (which I'd prefer not to do, for a couple of reasons).

(Part of the problem here is that our current set of anti-spam questions has yet to be defeated; they're easy for any actual enthusiast, but it's still specialist knowledge*, so it stops spammers dead. If we had a few spammers getting through before, then twice as many would have warned me that twice as many spammers were trying, but no spammers were getting through before, so I have no idea if more people are trying).

*But we do have a contact e-mail in case someone legitimately can't answer them.


Marco

Offline a10

  • Charter Member
  • Sr. Member
  • *
  • Posts: 985
Re: Tracking failed sign-ups?
« Reply #1 on: February 17, 2020, 05:53:01 AM »
Just search\count in the server logs.
Visited the site, 114 guests, if it was 114.000 I'd really see a problem :O)
"resource limits on our server", running own setup, or a (bad) host issuing warnings?
2.0.17, ssl, php 7.3.16, 10.3.21-MariaDB
Mods: Contact Page, Like Posts, Responsive Curve, Search Focus Dropdown, Add Join Date to Post.

Offline MarcoSkoll

  • Newbie
  • *
  • Posts: 6
Re: Tracking failed sign-ups?
« Reply #2 on: February 17, 2020, 07:55:59 AM »
A good host issuing warnings. Yes, we're on a modest hosting package, but the limits have always previously been sufficient, and they've provided us with excellent service for the money. I'm actually currently trying to work this through with the hosts, and their response hasn't been "screw you, buy more services from us", but trying to help us work out what's eating up the resources.

In this case, the site's resource usage has spiked since the 26th January, and we're trying to track down why.

Nothing currently seems to be out of place. While we had a large increase in guests around the 22nd (up to 1400 from an average of 100-200) that we can't currently explain (and which the server seems to have handled fine, as we didn't even notice until later), it since dropped back down to the normal levels and the problems have started since.

And we're not showing an unusual number of failed log-ins (just a few in the last month, all of which were from the correct IP addresses for those users). That's why I'd like to know if we're getting a particularly huge number of sign-up attempts - I'm not seeing a particularly ridiculous number of guests on the log showing as signing up, but an actual figure on it would be useful.

Offline Sir Osis of Liver

  • SMF Super Hero
  • *******
  • Posts: 10,141
  • Hoarding Budweiser in NY
Re: Tracking failed sign-ups?
« Reply #3 on: February 17, 2020, 11:42:57 AM »
If you're running on cpanel server you should be able to get detailed activity stats in Metrics (try Awstats).  Will show you breakdown of page hits.

Offline Illori

  • Project Manager
  • SMF Legend
  • *
  • Posts: 52,363
Re: Tracking failed sign-ups?
« Reply #4 on: February 17, 2020, 11:53:47 AM »
but that will not show attempts at registering. just number of people that may end up on that page.

Offline Sir Osis of Liver

  • SMF Super Hero
  • *******
  • Posts: 10,141
  • Hoarding Budweiser in NY
Re: Tracking failed sign-ups?
« Reply #5 on: February 17, 2020, 12:14:20 PM »
You have to use what you can get.  Host support should be able to determine where traffic is coming from.  Been seeing this a lot lately, huge spikes in traffic.  Some hosts will limit or suspend account when this happens.

Offline MarcoSkoll

  • Newbie
  • *
  • Posts: 6
Re: Tracking failed sign-ups?
« Reply #6 on: February 17, 2020, 04:38:38 PM »
Unfortunately, the metrics only show it as our index.php page, it doesn't seem to track the specific sign-up page.

However, going through the metrics, it does seem that some of it may be msnbot, which has already this month done more trawling than it did in the whole of last month, so I'm going to try banning it via robots.txt and see if that improves things at all.

I don't really want to go banning search engine crawlers, and I may take less drastic measures if it seems to ease the problem, but might as well be sure.

Offline a10

  • Charter Member
  • Sr. Member
  • *
  • Posts: 985
Re: Tracking failed sign-ups?
« Reply #7 on: February 17, 2020, 04:54:43 PM »
Sudden & very unwanted influx of visitors do happen, example > https://www.simplemachines.org/community/index.php?topic=570548.0

If really bad, stop them using htaccess (for as long as the 'attack' lasts).
2.0.17, ssl, php 7.3.16, 10.3.21-MariaDB
Mods: Contact Page, Like Posts, Responsive Curve, Search Focus Dropdown, Add Join Date to Post.

Offline MarcoSkoll

  • Newbie
  • *
  • Posts: 6
Re: Tracking failed sign-ups?
« Reply #8 on: February 18, 2020, 09:44:15 AM »
Although it would still be nice to be able to track the number of failed sign-up attempts, I think I've mostly resolved the problem.

It seems that msnbot was being particularly aggressive about indexing the site, frequently making several requests at the same time; it probably didn't help that another admin had managed to put a formatting error in our robots.txt file so the crawl-delay parameter wasn't valid.

I've updated the robots.txt file, and as msnbot doesn't seem to be checking the file regularly, I've barred its IP ranges until it resets, checks for the file again, and starts playing nice.
I've also banned a few IP ranges that were generating unreasonable levels of traffic (but no actual registered users) in the hope that this will also free up resources. (And, certainly, our number of online guests has considerably plummeted. Most of the traffic that wasn't msnbot was mainly from three fairly narrow ranges).

Offline a10

  • Charter Member
  • Sr. Member
  • *
  • Posts: 985
Re: Tracking failed sign-ups?
« Reply #9 on: February 18, 2020, 12:29:42 PM »
Just a comment, today got flooded with continuous hits from 114.119.131>166 (huawei, again).
.htaccess to stop the rats.
2.0.17, ssl, php 7.3.16, 10.3.21-MariaDB
Mods: Contact Page, Like Posts, Responsive Curve, Search Focus Dropdown, Add Join Date to Post.

Offline Antechinus

  • SMF Friend
  • SMF Master
  • *
  • Posts: 25,109
  • Master of BBC Abuse
Re: Tracking failed sign-ups?
« Reply #10 on: February 18, 2020, 04:21:57 PM »
Code: [Select]
<IfModule mod_rewrite.c>
RewriteCond %{REMOTE_HOST} All\.of\.bloody\.China
RewriteRule https://www.youtube.com/watch?v=wZZ7oFKsKzY [R=301,L]
</IfModule>

Offline a10

  • Charter Member
  • Sr. Member
  • *
  • Posts: 985
Re: Tracking failed sign-ups?
« Reply #11 on: February 18, 2020, 04:53:04 PM »
^^^ great. lol. & an alternative https://www.youtube.com/watch?v=eBPfnj8_4W4

For forum ban list, security.php

      // You banned, sucka!
      redirectexit('https://www.youtube.com/watch?v=eBPfnj8_4W4', false);
2.0.17, ssl, php 7.3.16, 10.3.21-MariaDB
Mods: Contact Page, Like Posts, Responsive Curve, Search Focus Dropdown, Add Join Date to Post.

Offline YogiBear

  • SMF Hero
  • ******
  • Posts: 1,972
Re: Tracking failed sign-ups?
« Reply #12 on: February 21, 2020, 10:45:41 AM »
I lurve that video.  ;D ;D ;D
SMF v2.0.17  Mods : Ohara YouTube Embed v1.2.9,  Custom Tab v1.2 , Bakers' Dozen Pages v1.2 , SMFPacks Shoutbox v1.1,  Board Color & Icons v1.1 , Simple Image Upload , Snow & Garland v1.4
PHP  v.7.3.6

Online SpacePhoenix

  • Jr. Member
  • **
  • Posts: 164
Re: Tracking failed sign-ups?
« Reply #13 on: February 21, 2020, 03:03:32 PM »
What about this Youtube video to redirect them to: https://www.youtube.com/watch?v=k85mRPqvMbE

Offline Antechinus

  • SMF Friend
  • SMF Master
  • *
  • Posts: 25,109
  • Master of BBC Abuse
Re: Tracking failed sign-ups?
« Reply #14 on: February 21, 2020, 03:31:45 PM »
If you have to ban people, you might as well have fun with it. :)