exxos's Atari, Amiga & retro forum

PhilC wrote: 24 Jun 2026 10:40 Any way to change font colour in dark mode? That blue is awful

If you can trace the colour css it can be changed on the server. No simple way to do it, it's all fixed in the theme somewhere.

exxos wrote: 25 Jun 2026 11:28

PhilC wrote: 24 Jun 2026 10:40 Any way to change font colour in dark mode? That blue is awful

If you can trace the colour css it can be changed on the server. No simple way to do it, it's all fixed in the theme somewhere.

Thought as much, I'll stick with the light one for now then.

More firewall refining going on. Problem is the flood traffic dynamic keeps changing making it difficult to keep on top of.

Fail2ban is basically worthless these days. I mean years ago, all I really had to worry about was people trying to hack the email server. Now it's pretty much a thing of the past. I've retired some more jails as they caught nothing for months. A lot gets dealt with higher up in the chain now anyway.

The problem these days is the botnets. Life was simple when there was grouped small ranges of ips flooding with requests. Now we get 1 bad IP across thousands of /24 blocks. 1 bad IP out of 255 block which at most only hits once a day. Nothing by itself. But the vast ip ranges which are doing exactly that total into huge requests per second.

So I'm being a lot more aggressive with detections now. We don't get users from pakistan for example, and that's where a lot traffic is coming from. So many bad IP detections and the whole country gets banned now. The harder part is filtering USA traffic. It's dealt with differently, but whole networks will get banned from now on.

Its at the point, as I feared a couple years back, that half the world will simply get banned. Leaving us with more common countries like uk and USA etc. We get some users from EU, france Germany etc also. But trying to keep on top of all this is a full-time job now for me. One which clearly isn't ever going to end.

Even every blocklist is pointless these days. I gave up because by the time enough users reported enough bad traffic, it's already to late. Plus I've searched the lists for ips hitting us and there's almost nothing listed in any list anyway. I mean fail2ban and blocklists should be enough, but nope. As I said before, fail2ban can't even keep up anymore. It ended up more resources than it saved in the end. There's not many avenues left to explore.

Its almost doesn't matter how efficient I make the server. The traffic just keeps on increasing. Even bashing 444 errors directly from nginx can't keep up with some floods. I forget how efficient nginx is, all I know is it can take one hell of a beating and even that couldn't keep up when meta was flooding us. Nevermind all the other botnets piled on top.

Registered users need to stay logged in as much as possible as you get temp whitelisted. This only works if you have a fixed ip though!

I got some unban requests over the past few weeks but users who got whitelisted get unbanned automatically about once an hour. So there's no need to request a unban right away. I can't be in front of the pc 24/7 anyway, which is why it's done automatically. If anyone is banned for more than 2 hours, either your not logging in often enough or your on a rotating ip which changes to often to keep track of.

The WIKI should behave again now. It was refusing connections over the paste few days. That was because I switched over to HTTP3 for tests, gave up, then forgot to remove HTTP3 from the WIKI config. Anyway, should be fixed back to using HTTP2 now !

740 million blocked IPs so far. That is about 17% of the entire IPv4 space blocked now. Those are prettymuch all botnets.

What's going on with the forum lately (botnet floods explained)

Right, so some of you might have noticed the odd hiccup over the past week or two. The short version is the forum and wiki have been getting absolutely hammered by botnet floods. Not a targeted attack as such, just relentless waves of automated junk traffic battering the server around the clock, coming from hundreds of thousands of infected machines all over the world. The forum and the wiki both seem to be the main targets.

To keep everything online I've built up a layered defence that spots the bad traffic and blocks it automatically. A few days ago it was holding back around 17% of the routable internet. After the last couple of nights it's crept up to roughly 21%, which is very nearly 800 million IP addresses, almost all of it in parts of the world the forum gets no real visitors from anyway.

Have a think about that for a second. To keep one small retro Atari forum ticking over, I'm having to block more than a fifth of the entire internet. It really shows you how much of the online world in 2026 is just compromised, malware riddled machines being quietly rented out as botnets without their owners having the faintest idea.

Just to be clear, this is only the bad bots. The legitimate search engine and archive crawlers are all still welcome. The good ones identify themselves properly, obey robots.txt, don't flood, and publish their IP ranges so I can wave them straight through. It's the anonymous junk pretending to be real browsers that gets blocked.

Who's the worst? Vietnam and Malaysia by a mile this week, with big waves out of the Middle East too (Pakistan, Egypt, Algeria and the Gulf states), plus Indonesia, Brazil and a long tail of everywhere else. These are nearly all ordinary home broadband connections that have been infected and roped into a botnet without the owner knowing a thing about it.

So why us? A little Atari forum? Honestly it's a bit of a puzzle, but here are a few theories:

• We're just a target of opportunity. Botnets crawl the whole internet looking for anything that responds. A forum with thousands of pages and a big wiki is a juicy looking target to a dumb script, regardless of what the content actually is.
• Badly written scraper bots. This is my favourite theory, because the "leeching our content" idea doesn't really add up. We're a small site. A sustained flood like this could download the entire forum and wiki in a couple of hours flat. So why keep hammering it for days and weeks on end? Either the bots are so badly written they don't know when to stop, or they're just mindlessly re-scraping the same pages forever. Incompetence on an industrial scale, basically.
• Session and login probing. A big chunk of it is bots throwing fake session IDs at the forum, poking at it to see if there's a way in or just to generate load. Old phpBB forums are a well known shape on the internet, so the scripts know exactly what to prod at.
• Someone's actually driving it. Here's the interesting one. A week or so back we were under a heavy flood and it stopped dead at around 10 or 11 at night. Not tailed off, not gradually eased, just switched off like a tap. Random internet noise doesn't do that. That strongly suggests there's an actual person, or a very small number of people, sat at a control panel somewhere turning this thing on and off. Which means at least some of this is deliberate, even if the reason why is anyone's guess.

I genuinely don't know which of these it is, and it might be a mix of all of them. But that "switched off at 11pm" moment has stuck with me, because it means it's not purely mindless. Somebody, somewhere, has their finger on the button.

The good news: you lot are fine. Logged in members always get proper live pages, and the blocking goes easy on the UK, US and Europe where you actually are. If you're reading this, you got through no problem.

If you ever do get blocked (unlikely unless you happen to share a chunk of network with infected machines):

• Most blocks now clear on their own within the hour on the automatic cleanup, so nine times out of ten just wait an hour and try again.
• Still stuck after that? Log in from a different connection (your phone on mobile data does the trick) and fire off an unban request here: https://www.exxosforum.co.uk:8085/IP_CHECK/. That's the fastest way to get an address cleared.
• To stay on the permanent whitelist, just be logged in for at least an hour a week. Regulars basically never get caught out.

Want to see if we're getting hit? Have a look at the "users online" count at the bottom of the board index. Under about 1,000 guests is normal. Around 2,000 or more and we're getting a proper kicking. But here's the thing, that number is only the tiny fraction that actually makes it through to the forum software. For every "guest" you see in that list, there are loads more being turned away at the firewall before they're ever counted. Right now the board might show a few thousand, while behind the scenes tens of thousands of separate machines an hour are hitting the server and getting blocked. As long as that visible number isn't creeping up hour after hour, the defences are staying on top of it.

And a personal note. I'll be straight with you, this lot has basically taken over my life the past few weeks. Nearly every spare minute has gone on watching the traffic, pulling apart each new attack pattern and writing custom scripts to deal with it. The annoying part is it never stays fixed. The traffic ramps up every month or so, and whatever worked last month falls over the next, so each new wave has to be studied and beaten from scratch. It's turned into a full time job in all but name, and it's why I've had next to no time for hardware, or anything else lately.

So with almost a quarter of the internet now blocked, fingers crossed things stay quiet from here on. Realistically that number's only going to keep climbing over the next few days and weeks, and yeah, it sounds completely mad to be blocking that much of the internet just to run a little Atari forum, but that's the state of things in 2026.

Anyway, the forum's coping well and it's business as usual. Cheers for your patience, and as always, keep the retro chat coming. :)

Girlfriend sent me this one..

https://websleuths.com/threads/google-d ... 99mWezEpAE

Many have you have noticed the last several days have been rough with a ton of automated 'bot traffic. If you haven't noticed, then I'm going a better job at hiding it from you than I thought, but just in the last 36 hours we've been hit with over 6 million connections to the site when we usually get about a million and a half. Our server can handle the load, but it usually takes a little while for our load-balancers to come up to speed, which makes the site very slow at times.

Normally, I would locate the server or servers where all this automated traffic was coming from and block them from accessing our site entirely. Problem is, these past few weeks, the traffic seemed to come from EVERYWHERE, ALL AT ONCE; not just datacenters in India, China, and Brazil – this traffic was coming from people's houses! That made the traffic hard to pin down and block.

Today, Google announced they've shut down one of the more notorious residential proxy companies in the world, NetNut.

And they are behind Cloudflare as well!

Wiki: guest access to page histories and editing tools has been restricted

Quick heads up on a change to the wiki. Over most of this weekend the wiki was intermittently down, and I've tracked down why.

The culprit was crawler bots, PetalBot (Huawei's search crawler) being the worst offender, hammering the wiki's "expensive" pages. Things like page histories, edit views, and the various Special: pages. Unlike normal article pages, these can't be cached. Every single hit has to be freshly generated from the database, which is slow and heavy on the server. PetalBot alone was firing off thousands of these requests while completely ignoring the crawl-delay in robots.txt that politely asks bots to slow down. Multiply that across several bots all doing the same thing and the wiki simply couldn't keep up, so it kept falling over.

So I've made two changes:

• PetalBot is now blocked at IP level. It's a genuine Huawei crawler, but it wasn't playing nice, and frankly Petal Search sends us zero real visitors anyway (it's a search engine for Huawei phones, mostly used in Asia). No loss to us.
• Page histories, edit views and special pages now require you to be logged in. Guests browsing the wiki won't notice any difference. All the actual articles and content are still completely open to everyone, exactly as before. It's only the behind-the-scenes tools (edit, history, "what links here", etc) that now ask for a login.

Before anyone says "but a wiki is supposed to be open to all", a couple of points. Firstly, reading the wiki is still open to all, nothing has changed there. Every article is fully readable by anyone, no login needed. Secondly, editing here was already restricted to approved accounts anyway, so guests were never able to edit in the first place. All I've done is stop bots from being able to hammer the editing and history machinery that guests couldn't use regardless. Nobody has lost any ability they actually had.

The alternative was the wiki continuing to fall over every time a badly behaved crawler decided to scrape it, which helps nobody. This keeps it fast and online for the people who actually use it.

If you're a logged-in wiki editor and you hit a "login required" message on something you think you should be able to access, let me know and I'll sort it. And if you spot the wiki being slow or down again, give me a shout.

Theres are also 50+ server updates to install next.. So may be some seconds outage during updates.

EDIT: 54 updates now done.

Forum performance / caching changes (and an honest word on where this is heading)

A quick note on some behind-the-scenes changes, as regulars may notice guests now see slightly "older" pages.

For the past year or so, bots have quietly been served a cached copy (around 10 minutes old) while real visitors still got live pages. That worked on one simple assumption: no cookies = bot. A real browser keeps cookies, a bot didn't. Easy tell.

That no longer holds. The current wave of scraper traffic now keeps and replays phpBB's own session cookies and session IDs, so "has a cookie" and "has a valid sid" no longer means "is a human". Those signals have become trivially faked, which quietly broke the logic everything was built on. Honestly, trying to reliably tell good traffic from bad has become basically impossible, and I've largely given up trying. The effort chasing it was endless and every fix bought days at most.

The scale of it, for context: nginx logs hit around 130MB in nine hours (normally nearer 20MB in a whole day), roughly a 15x flood. Hundreds of thousands of requests an hour from thousands of rotating residential IPs worldwide, all wearing the same fake browser fingerprint, each inventing a throwaway session ID per request. To put a number on it: "Most users ever online was 90754 on Fri Jun 12, 2026", and that is only what got past the cache and firewall. Actual traffic was easily 100x that. The flood we've just weathered is around 15x bigger again. The bots hit hard enough to scrape the entire forum in under an hour, yet they just keep coming, harder and harder, for no reason I can see and with no end in sight.

It wasn't just the wiki getting hit with fake URLs either. The bots also stuffed junk into forum URLs that quietly slipped past the caching, so requests that should have been served instantly were still hammering the backend. Working out exactly how that was happening, and why a "working" cache still wasn't catching this traffic, took many, many hours of tracing before the picture finally came together.

Serving cached pages safely turned out to be a minefield too. Get it slightly wrong and a member's own page can end up cached and shown to a guest. At one point that produced odd half-broken pages with the login box or recent topics missing and member-only bits leaking to logged-out visitors. Pages like the FAQ, rules and memberlist caused their own headaches and had to be handled separately. A lot of the work was making absolutely certain a logged-in member's content can never leak into the cache everyone else sees.

So the approach had to change. To keep the forum fast and the server alive, all guests and bots are now served a cached copy that can be up to 2 hours old. Logged-in members always get live, up-to-the-second pages, so this only affects logged-out viewing. If you're logged out and a thread looks slightly behind, that's why; log in for the live version.

The wiki (atari-wiki.com) is a tougher problem still, and I'm honestly not there yet. Its pages don't cache anywhere near as easily, and it's trivial to fake page URLs that dodge the cache and hammer the backend directly. I'm still looking for a workable fix, but I'll be straight: if things get worse, putting the wiki behind a login to view any content isn't off the table. I don't take that lightly and it's a last resort, but I've more or less run out of other options.

The bigger picture

Everything here runs from a RAM disk and has done for a couple of years, as it's the only way to keep response times sane. But the flooding means I need more and more RAM just to stand still, and we're already around 2GB short. The server has 4GB and it simply doesn't cut it anymore. Even 6GB would be the bare minimum now, purely to absorb what we're being hit with. RAM buys maybe 10% headroom before the CPU becomes the bottleneck instead, and the next server tier roughly doubles the monthly cost, for nothing but fighting bots. The funds for that aren't there.

I'm still blocking IP ranges: the Middle-East floods are almost entirely walled off now, but the traffic has largely shifted to Germany, which is awkward because we have legitimate German members, so range-blocking there risks real people. New script changes make sure the very worst offenders still get dropped, and the big floods are caught, but we are genuinely down to the wire. What's left is a short list of bad options: hide the whole of exxosforum / exxoshost behind a login (which would wipe us off search engines), sit behind something like Cloudflare (which, from what I've seen, doesn't reliably help with this kind of thing), or keep throwing money at resources I can't sustain indefinitely.

I've made the server about as efficient as it can be, there isn't much left to squeeze. And this is all on top of the normal never-ending grind of just keeping the thing running. How any small forum survives in 2026 is honestly starting to feel like a small miracle.

For now: nothing members need to do changes, and everything works as normal once you're logged in. Thanks for bearing with it, and for still being here. Cheers.

EDIT: A note on the wiki specifically. The actual wiki content is still live and viewable by everyone, though most guest views are now served from a cached copy. The problem pages were things like edit forms, page histories and special pages, where bots were faking thousands of URL variations that each forced a full backend rebuild, and that was enough to take the wiki offline entirely at one point.

So while the content itself stays open, those heavier pages are now restricted to logged-in users only. My priority throughout has been balancing keeping the sites visible and useful to guests, without being so open that the traffic and problems become unmanageable. That balance keeps getting harder to hold.

I've noticed a load of errors in the log relating to downloading files. I think its because the ram disk size I allocated to nginx chokes on large file downloads and I don't know what the outcome would be. Maybe corrupt files, or incomplete downloads, or maybe no problem at all ?! I've not had any reports of failures.

Anyway, that problem should now be fixed. I am just doing tests to ensure so.