Getting a lot of "502 Bad Gateway" errors

[Stray Electron]

  Perhaps. But I HATE Captcha!   I won't work for me on some web sights and I've had to entirely abandon using those websites.  AND it's a PITA to deal with. 

[EEVblog]

Any idea on how you got on someone's shit list?

Absolutely no idea.

[gnif]

Question:

Would it help to require all users to solve a CloudFlare captcha (like the simplest "click on the box" one) before first logging on or accessing the site?

I wouldn't mind having to do this at all if it helped reduce the bot attacks.

We are already doing this but only for targetted IP ranges. The issue with doing it globally is it breaks indexing by bots we do like, such as Google.

[EEVblog]

We are already doing this but only for targetted IP ranges. The issue with doing it globally is it breaks indexing by bots we do like, such as Google.

Yes, we like the good indexing bots, the high searchability of this forum is one of the great thing about it.

You can see the current bots indexing the forum in the stats:

[PA0PBZ]

You can see the current bots indexing the forum in the stats:

Where is that? I've never seen it, is it maybe something only mods can see?

[Analog Kid]

The site was completely inaccessible for the last couple hours for me.

[tautech]

Forum is near unusable today.
Constant 502's.......

[EEVblog]

It's Vietnam again

[EEVblog]

For those who haven't seen gnif's update:

So just a update on this.

A huge amount of traffic is being routed through AirTel (Indian provider) which has been difficult to nail down due to the enormous IP ranges they own and lack of consistent records for identifying them. I have found a way to identify them and I am working to implement it now, unfortunately it's a wide net but we have little option at this point. I am sorry to our Indian users that will be forced through the captcha gate now.

Edit:

If anyone is curious as to what is going on and why this has become such an issue. These bot farms are using proxies via desktop and mobile free addons/games, etc. Often the user has no idea that the "free" app they installed includes this in the agreement for using the product. This allows the bot farms to hide behind thousands of devices, blending their malicious traffic in with the general noise normal activity. There are some apps that even give the user's a kick-back for installing it on their phone, usually with the concept of getting paid for "sharing unused bandwidth". Google has been working to ban products that are acting as a proxy on their app store, but the damage is already done and we are left holding the bag.

So basically we can't just block bots because it's not a just a few servers or one country, it's apps on individual users phones or PC's being used as the bots. Hundreds of thousands of different IP's.

[KungFuJosh]

I sent you an email Dave, but the solution is here: https://developers.cloudflare.com/fundamentals/reference/under-attack-mode/

Turning that one will (maybe) give humans a checkbox to click, and block the bots.

Thanks,
Josh

[EEVblog]

I sent you an email Dave, but the solution is here: https://developers.cloudflare.com/fundamentals/reference/under-attack-mode/
Turning that one will (maybe) give humans a checkbox to click, and block the bots.

We've already had this on for months through Crowdsec and other custom solutions since the last bot attack.
But I know that only works at the server level, not the CDN/DNS level.
gnif is working non-stop on it. There is a reason we bypass Cloudflare even know our DNS is technically hosted there, it's in DNS bypass mode.

[peter-h]

331k guest requests

I am an admin on a tech forum (aviation related) and we have been hit with big DDOS attacks. They totally brought the site down - just like is happening here. If you look in your server log it is immediately obvious. They come from rented botnets from all over the world. Every one is a new IP so traditional measures do not work. The browser agent strings are all valid too, etc. and they come from residential IPs because they are infected remotely controlled private PCs and laptops.

There is no defence apart from

- a much faster server and bandwidth ($$$)
- Cloudflare, and enable Precursor in the High mode - a new feature, very effective and not visible to real users

CF is free to nonprofit organisations. Not sure if EEVBLOG qualifies because you carry adverts (ours is donation funded) but the bottom paid CF tier is very cheap.

I highly recommend CF.

On ours we also use CF to firewall whole countries, because they generate a lot of attacks and hacking but are not relevant to the forum topic. So we block all of China, Russia, and some others. Traffic from those is 99.999% malicious. EEVBLOG can't do that.

We also firewall some server farms because they host a lot of bot attacks. They are not ISPs and people won't access the forum from their IP ranges (unless reading the forum via a VPN terminating there, which is a tiny minority, and who is legitimate and reads EEVBLOG over a VPN???).  Digital Ocean is one. Hetzner in Germany is another big one and if you complain they tell you to get lost. I know someone who blocked AWS and immediately reduced his server load by 95% but I gather google sometimes use AWS and you do want SEO. You should also not block Claude like you currently do. Claude is the "new SEO" nowadays.

CF offers about 10k IP ranges to block for free. It is simply amazing.

Forums also do accumulate enemies. Probably less in electronics than in aviation but still... People who have been banned get extremely angry and want revenge. So you have to deal with all of that, and botnets are cheap to rent these days.

There is no downside to CF. It also gives you free HTTPS certificate so that is one less thing to break when the renewal cron job breaks. You have to enable some pass-throughs in CF for stuff like Paypal if you accept payments that way.

[benj38]

...and who is legitimate and reads EEVBLOG over a VPN???

I am surprised you think that.
Almost always, when one has a VPN on, all the internet traffic goes through it.
In other words, it would be extremely rare for someone who uses a VPN, for whatever reason, to selectively redirect EEVBLOG traffic to avoid the VPN, or turn the VPN off whenever one wants to quickly look at something on EEVBLOG.

I am sure you are not implying that most people who use a VPN do not do that for "legitimate" reasons, as that would be so off the mark I would not know where to begin.

[peter-h]

I do not doubt "you" exist but data shows that you are somewhere way below 1%. Do you know which server farm your VPN terminates on? You should.

Anyway, blocking server farms is just one of the low hanging fruits for reducing server load by big chunks. Cloudflare's Precursor (in HIGH mode, not the other one) deals with DDOS attacks effectively.

[EEVblog]

TEST, 10:14pm Sat 12th Sydney time.
Enabled Cloudflare proxy with Under Attack disabled.
Didn't work properly in Under Attack mode.

[EEVblog]

TEST, 11:24pm Sat 12th Sydney time.
Enabled Cloudflare proxy with Under Attack ENABLED
Very slow, but sometimes working.

[peter-h]

You need Precursor



Currently I see two different captchas enabled, perhaps unintentionally. One is CF Under Attack and the other is something else.

[EEVblog]

No option for Precursor

[EEVblog]

Currently I see two different captchas enabled, perhaps unintentionally. One is CF Under Attack and the other is something else.

Yes, we have had one (crowdsec) on the server for a few months now.

[EEVblog]

Oh, it's super snappy right now, instant!
Something just changed...

[PA0PBZ]

Yes indeed, it's alive again! And only 1K guests, was it gnif?

[peter-h]

Google for

"cloudflare precursor not available in Settings"

Precursor is THE way to go today. Much better than Under Attack mode.

[EEVblog]

Yes indeed, it's alive again! And only 1K guests, was it gnif?

I don't know if he's asleep right now (he didn't sleep last night!) or he's beavering away, haven't been able to contact him, but I took a chance and turned the Cloudflare proxy on (it's been in DNS bypass for years now) and enabled under attack mode. That was an hour and half ago as I type this, and it would sometimes load and sometimes 502 timeout on cloudflare, and I was able to post briefly twice, but it was very weird.

[EEVblog]

Google for
"cloudflare precursor not available in Settings"
Precursor is THE way to go today. Much better than Under Attack mode.

"Cloudflare Precursor is an opt-in feature tied to Cloudflare's Enterprise Bot Management plan, meaning it will not appear for Free, Pro, or Business zones. [1] (https://securityboulevard.com/2026/07/cloudflare-precursor-extends-bot-detection-beyond-browser-checks/), [2] (https://decodo.com/blog/cloudflare-precursor-explained)Why It's MissingPlan Requirement: Precursor requires an Enterprise subscription with Bot Management enabled."

I'm on the free plan.

[peter-h]

I am on free plan too but (UK) get it.

Looks like a regionally controlled feature.

Their only free version "support" is a forum - worth a try.