502 Bad Gateway

[Jujube]

The last few days, I’ve been getting the message 502 Bad Gateway when I try to navigate the site. This happened on all my devices. I even tried restarting my devices but to no avail. I don’t see any restrictions I’m using that will cause this. Have you been having trouble with your servers?

[craven mohr]

Hi,

I also can confirm "502" errors. Yesterday was really bad. Other websites were operating normally.

This isn't the first time. In past incidents, I noticed that if I logged-in, the site worked. So, I tried clearing the OHW cookies and that fixed it. Yesterday, that did *not* work.

I'm betting it was a server or router problem. It got slightly better thru the afternoon (eastern time here). So far, it seems to be working today.

[afagehi7]

Yes, we're having an issue outside of the site with the host. It's outside of our control. It's a server or routing problem most likely or they were attacked or something like that.

Sorry, we're as frustrated as anyone. Armyguy has been dealing with their ticket system and process.

[Jujube]

I also have had a problem logging in for the last two weeks. I have to check “remember me” beforehand or it usually doesn’t work, and if I go to the next page, it’s kicked me off and I have to log in like that again.

[leander99]

I have seen these errors a lot the last few days. Since this morning I haven't seen the error any more, so maybe it has been resolved.
This is/was most likely an issues with a server somewhere, so an issue for the hosting provider probably.

Let's see how it goes the next few days. But I think the issue may have been fixed.

[boobman987]

Yes, we're having an issue outside of the site with the host. It's outside of our control. It's a server or routing problem most likely or they were attacked or something like that.

Sorry, we're as frustrated as anyone. Armyguy has been dealing with their ticket system and process.

Thanks for letting us know. It’s a great relief that it’s not your users but the system it runs on. Phew!!!

I hope Armyguy and you get to the bottom of this and get a longtime solution.

[chris]

Hi all, I just checked the logs etc., and there appears to be a low-level ddos attack on this site. Appears to be originating from Singapore. Hoping it'll clear up in the next day or two. If not, there are things we can do to mitigate (add Cloudflare or similar).

[leggysman]

Hi all, I just checked the logs etc., and there appears to be a low-level ddos attack on this site. Appears to be originating from Singapore. Hoping it'll clear up in the next day or two. If not, there are things we can do to mitigate (add Cloudflare or similar).

Hey chris!

I just noticed the same thing going on with my own phpBB board in the last day or so. Same thing, same symptom (502) and there's a heavy load and ~2500 guest users active. I guess 502 is phpBB's way of saying that the SQL database is overloaded.

In my case, most are coming from the IP ranges 47.79.*.* and 47.82.*.* (and a few from 47.236.*.*). Yup - Singapore.

The last time I saw something like this, it was some dumb 'AI' spider (Anthropic/Claude) just endlessly cycling though the posts, as if it was stuck in a recursive loop. I could identify them by the User-agent string and block them that way; this time they are identifying as browsers like

Code: Select all

"Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"

so all I can do is block the IP ranges for now. It's a blunt tool, but it gets the job done.

In the relevant server block of my Nginx configuration:

Code: Select all

# Block IP ranges
deny 47.79.0.0/16;
deny 47.82.0.0/16;
deny 47.236.0.0/16;

[thesvs_09]

So, like an AI is scraping this site (may be using it for some training) ? Correct me if I am blatantly wrong.
Anyways, problem is still persisting. I am getting "502" as well as "504" errors. Whenever the site opens, it is way too slow. I hope it soon gets resolved.

[leggysman]

It looks like that in my logs, yes. It doesn't look like an attack per se; I don't know why a single bad actor would want to DOS various phpBB boards covering different subjects. It looks like it's just fetching topics, scraping/crawling the whole site.

If a robot tries to crawl a phpBB board as if it were a normal web site, I'm not surprised if it goes into a death spiral. It is tricky to fetch even just whole, single thread and its attachments, in its entirety, without following all of the circular linking here - I've done it (I wrote a script) but it took some trial and error. Think: your post has a link to your profile, which has a link back to all your posts, which all have links to your profile ... there's tons of that sort of thing on a phpBB board.

The search engines and 'AI' wallahs all slurp content from discussion sites (how else would chatbots regurgitate advice about things like feelings?) but some do it more intelligently than others. ChatGPT was scouring my board just today, but never fetching at a rate of more than one per second. That's fine - although I blocked it anyway since I was trying to spot the bad guys in my logs.

[chris]

Hi leggyman, thanks for the recipe! I added the block you suggested with the IP addresses you suggested, and that seems to have taken care of it. How annoying!

[leggysman]

Excellent! I'm delighted to have helped. There are a few other IP ranges that looked suspiciously similar, but as it is you're now blocking ~200K Singaporean IP addresses (the requests were coming from lots of different subnets in those ranges) - as I say, it's a blunt tool. Best to use it sparingly, if blocking those 3 ranges gets the site back on its feet.

Whoever is behind this thing is an amateurish clown. My server started returning "403 Permission Denied" to that crawler several hours ago, and it's still blasting away undeterred - as if permission is suddenly going to be re-granted

[chris]

Thanks again! The main thing was getting the site back on its feet, yeah, so I could keep looking at Hotties photos

I think a longer-term solution to this type of problem is probably cloudflare or similar.

[leander99]

I had issues with the site all day, but it seems to be OK now.

[Mwstag]

If you google "Malicious bots behind nearly half of web traffic in S’pore: Study", there is a very good article on it.

[afagehi7]

If you google "Malicious bots behind nearly half of web traffic in S’pore: Study", there is a very good article on it.

Yeah... We're not using some no name hosting company out of someone's garage. It's a major provider so they should be able to easily block that stuff.