My Gopher site seems sluggish. I wonder what’s up...
top - 21:28:34 up 99 days, 5:38, 1 user, load average: 38.37, 32.55, 17.14
Well, load average approaching 40 gives me an idea...
$ bin/time-grouping-gopher < farm/gopher-server.log
Hour Connections [%] Selectors [%]
2018-07-15 06 25 1% 25 1%
2018-07-15 07 39 1% 39 1%
2018-07-15 08 33 1% 33 1%
2018-07-15 09 36 1% 36 1%
2018-07-15 10 32 1% 32 1%
2018-07-15 11 36 1% 36 1%
2018-07-15 12 40 1% 40 1%
2018-07-15 13 36 1% 36 1%
2018-07-15 14 38 1% 37 1%
2018-07-15 15 36 1% 36 1%
2018-07-15 16 37 1% 37 1%
2018-07-15 17 39 1% 39 1%
2018-07-15 18 38 1% 38 1%
2018-07-15 19 37 1% 37 1%
2018-07-15 20 32 1% 32 1%
2018-07-15 21 2324 81% 2288 81%
Yes indeed! I guess it’s time to stop the server.
And who did it?
$ bin/ip-numbers-gopher < farm/gopher-server.log | head -n 2
IP Connections [%]
90.154.53.13 2448 82%
Same guys like the other day!
$ whois 90.154.53.13|grep "org-name\|address"|head -n5 org-name: "Central Telegraph" Public Joint-stock Company address: 7, Tverskaya street address: 125375, address: Moscow address: RUSSIAN FEDERATION
I think I need to install the honeypot ckeen was talking about.
#Gopher #Russia
(Please contact me if you want to remove your comment.)
⁂
Time to take another look at the tarpit idea again.
– Alex Schroeder 2018-07-16 06:38 UTC
---
I just added default Surge Protection.
– Alex Schroeder 2018-07-16 07:41 UTC
---
Apparently it doesn’t help. I come back to the server and my web and gopher services are down. Load is up to 128. Fiddled with the code some more. As these people are forcing me to spend time writing code I’m not interested in because they wrote a gopher bot that requests pages faster than people usually read, I’m growing angrier every time I’m forced to look at this.
Right now their bot is behaving, though: twenty requests in around 50s.
– Alex Schroeder 2018-07-16 18:56 UTC
---
It is a promising sign of the Gopher renaissance that the Russian trolls are paying attention.
– Hans Gerwitz 2019-05-20 14:43 UTC