[3.3.x] Support Forum • Dealing with Brazilian botnet scanners

My site has been having issues with scanners for some months now, with the unfiltered traffic bringing it down in just a few seconds. Cloudflare is (unfortunately) not currently an option for technical reasons.

Solutions tried:

1. disabling guest users for most forums
2. iptables blocks on a couple of thousand /16 subnets
3. country code blocking - this is what I'm currently doing

Here is part of a histogram of a minute's worth of unfiltered traffic:

<snip>
10 JO
11 KE
16 MA
17 PK
17 US
18 EC
20 UA
20 UZ
25 ZA
31 BD
31 IQ
35 RU
40 AR
45 TR
48 -
946 BR

As you can see, Brazil is the main (though not only) source for this traffic by some orders of magnitude. The traffic appears not to be scanning the site, but rather hitting the login and memberlist pages.

The traffic I let through in that same minute:

1 BG
1 CA
1 CN
1 CY
1 CZ
1 GR
1 LK
1 MK
2 DE
2 HU
2 RO
4 FI
15 US
46 -

By let through, I mean that I am filtering quite a few country codes at the apache level with geoip. The bot traffic, when I did allow it through, was making login attempts and trying to view the member list.

My custom geoip stuff in my <VirtualHost> block (after enabling mod geoip and mod rewrite in apache)
I was happy to be able to remove my hacky /16 blocks with this approach, but I would be much happier if I could specifically identify this traffic. I still have no reliable logging method to distinguish the scanners from real users who are not logged in, despite my having added custom logging statements to the phpbb code to show me what each IP address is doing.

Statistics: Posted by textkit — Sun Mar 16, 2025 1:13 pm

---