Thanks for letting us know! I think many folks run scripts to scrape the website for group giveaways (to calculate ratio, detect wins play stats etc) as there is no available api for that. Will report back in case of issues!
Comment has been collapsed.
There's also the script we can run on our own entered giveaways to count the number of times we have tried for all games.
Comment has been collapsed.
might be helpful if someone links to the posts for each script.
I would help but only know 3, ESGST, do you play and poetickatanas play checking scripts >>
Comment has been collapsed.
Now it's clear why the site is slowing down so much that I have to turn on the VPN. Otherwise, I have to wait a minute + for the website itself and each page of the game (and then confirmation of participation) to load for each action.
upd: fixed - vpn is no longer needed
Comment has been collapsed.
Have you tried setting your DNS resolver to 1.1.1.1 ? Should improve page loading in theory.
Edit: According to your Steam profile you live in Russia. There might be issues with your internet entirely beyond the influence of Cloudflare even while using a VPN.
Comment has been collapsed.
no issues with vpns(except that most of the free ones being blocked) and reverse vpns there
Comment has been collapsed.
куда добавить, в какой запрет?
у тебя получилось решить проблему? у меня второй день SG страницы не грузятся, только с ВПН работает
Comment has been collapsed.
блин, как ты вообще ютуб смотрел все это время? гугли zapret(zapret-discord-youtube на гитхабе в ссылке будет) → скачать последний релиз → распаковать → запускать bat'ники по очереди (у всех в названии general) и обновлять страницу пока один не заработает(как нашел рабочий - юзай его каждый раз). Там в папке lists есть тхтшники, и в том, который general, уже добавлен клаудфлаер! можешь там стимгифтс написать если так и не заработает ни один батник и попробовать снова.
Comment has been collapsed.
Как вариант, можно отключить шифрование имени запрашиваемого домена (ECH - Encrypted Client Hello) в настройках браузера, если вам нечего скрывать от товарища майора. Как показала практика, правы были те, кто указал, что РКН агрится именно на эту технологию, а не конкретно на Cloudflare. К сайтам, действительно включённым в чёрный список, получить доступ таким способом нельзя.
Comment has been collapsed.
немного не понял, ты имеешь ввиду отключить безопасный DNS(который юзает ECH) в браузере? но на стороне клаудфлара он будет все еще включен... и что, клаудфлар вот так просто пустит незащищенный трафик, без капчи даже? интересный метод, но, чтобы юзать запрет для других целей - все равно переключать придется.
Comment has been collapsed.
Получается, что пускает. Капча будет (на steamdb.info, например). Если уже отлажено другое решение, в этом особой необходимости нет, конечно.
Comment has been collapsed.
но на стимдб капчу прошел и сайт работает, а тут не грузит ничего у людей и в раздачи вступать не дает, почему так?
edit: мог бы и ответить... я что зря 5 блэклистов словил?
Comment has been collapsed.
Thank you for this, idk why but my workplace couldnt run SG before cz it was blocked. Now it can!!
Time to waste time professionally!!🖤
Comment has been collapsed.
Same here, the site was flagged as “insecure” on my work connection.
Now with cloudflare, it’s considered “safe”.
Comment has been collapsed.
Finally, good news for living people and bad news for bots.
Comment has been collapsed.
I would not call this a "good news" (but it's an "internet" issue not SG). remember when websites would lose money if they took 1ms too long to load? now every page takes 10s with a captcha on top of it.
Comment has been collapsed.
Honestly haven't noticed a difference, pages still load quickly as normal. Thank you for the update~
Comment has been collapsed.
I would only be thrilled if really something happen.
For example handling the min. 1,3k autojoiner tickets from people around me and myself. They have all needed data to perma suspend them but they will get a 2 DAYS suspension, thats it. And to reach this still need YEARS.
Right now it is only again a layer of "i investigate the situation" as many years before too.
A Programmer, that still studied it, around me needed 1 week to write a program to detect autojoiners. It show very easily how fast something can be done WHEN someone really want to change it.
The only thing that it change is that i don't think anymore about deleting my account and go with a bunch of very big threads with a lot of accounts listed.
We will see what happend after 3 months.
My strong assume is NOTHING
Comment has been collapsed.
is this program marks every "thanks" message as autojoiner?
Comment has been collapsed.
He can't because i don't use it :-D
And if i would, it wouldn't react on a thx.
Because the annoying thx messages of the additional thx script users (only a few hundreds) are such a tiny minority of the autojoiners that they aren't the main focus.
I prefer to hit the ones that think they are smart and "hidden" :-D
Comment has been collapsed.
Not trying to be testy or anything but, I've seen you be outwardly unhappy with SG for years now, have you tried making your own website, exactly how you want it? I don't know how difficult such a task might be but I feel like it would be doable if you're passionate about making such a place.
Comment has been collapsed.
Not doable for me. Sad reality.
I don't have enough energy for it, mostly because of my chronic illness, and i have zero programming skills.
I am far from the only one that is unhappy with parts of sg, or what cg do or don't do, since years. I am only more vocal about it (germans are direct + honest and don't sugarcoat everything ;). And i have no fear of backlash -which means BL here at sg-.) because nothing move since years of A LOT of friendly help tries. [So, i don't talk only that others should do something, i done (and partly still do) a lot to help the site]
Help that needed cg to integrate a tracker for shady ru stores and the games there, to reduce the workload for the mods. Nothing happened, the mods and the users still have extreme amounts of work, if they not gave up already (i did years ago). One of the programmers around me (not finished studying it) done a program that listed for each user the amount of games from that sources, based on that existing tracker that i forwarded the mods and they cg. He needed ~1 week for it.
So the stuff don't need extreme amounts of time and they would help the mods and the users. So it isn't smart to not integrate/automate such stuff (at least that mods get a auto ticket for that games or better a automatic handling to set them to reduced/free).
And yes, such stuff is VERY frustrating when you try to help the site, the mods, the gifters, all the other users that don't exploit the cv system and invest hundreds or thousands of hours.
Comment has been collapsed.
Does it mean for sure no more bots and autojoin scripts or is cloudfare easy to bypass when someone really wants to?
Comment has been collapsed.
Overall, Cloudflare's antibot measures are a sophisticated defense system designed to protect websites from malicious bots, ensuring the integrity and availability of online services.
- Cloudflare
If autojoin scripts are flagged as malicious remains to be seen.
Comment has been collapsed.
It is built to mainly stop botnet attacks. People can still run "bots' to enter as those are different tech.
Comment has been collapsed.
its like easy anti cheat
it works for most people, but not well vs anyone who knows anything about said topic.
Comment has been collapsed.
Good! Some Spain users might get the website blocked during Sundays due to LaLiga (not joking), but that's more a legislative problem than anything to do with SG. Great addition imo.
Comment has been collapsed.
No, people will stop thanking me on public giveaways :(
Comment has been collapsed.
I'm not so sure about that. I think what Provos wrote is more realistic. SG becomes more resilient to DDOS attacks while autojoin scripts aren't blocked. Users have high expectations while cg doesn't disclose how his choice of Cloudflare as CDN will improve anything bot/script related.
Pardon my French: plus ça change, plus c'est la même chose.
Comment has been collapsed.
True, I was aware of that.
I don't really care that much about auto joining bots,
I was mainly trying to make a joke.
Comment has been collapsed.
I get that. Contrary to you I do care. Just the other day I came across a user with over 1,000 wins and less than 10 giveaways to his name. Not the only one I might add.
Comment has been collapsed.
It becomes even more "concerning" now that the level of giveaways has considerably diminished. I'm really not entering a lot of giveaways but It's such a letdown when your winner is someone like the one you wrote about.
Comment has been collapsed.
is it fully against the rules to ask for a re-roll in that case?
Comment has been collapsed.
Yes.
As long as they aren't suspended at the moment or in the last month, you can't let them reroll the winner.
If they have 3000 wins and never gave a game or any other stats.
Test it when someone with such a amount of wins and nothing/nearly nothing gifted by themself need to wait 3 or 4 days before you send the win. They get often wild and partly unfriendly.
You can let them wait 6 days and a bunch of hours, thats the maximum you can do.
Comment has been collapsed.
Masafor gave you the big picture. You can always blacklist him afterwards if you're not ok with that type of user.
Comment has been collapsed.
yeah, seems like the blacklisting after is a reasonable if not ideal countermeasure.
Comment has been collapsed.
Yes.
That's the reason why some of us, for example I, have 1k accounts blacklisted.
It lowers the amount of problems at and after own GAs.
Sure it takes a bit time but it isn't needed to fill it in 1 day :-D
I recomment to look at the entries in public GAs, i would start with the higher level ones, and check there at least the last 3 pages (so the first 75 ones that entered the GA) because you have there a good bunch of really bad ones (autojoiners, extreme stats etc.). Of course not everyone is a bad one but the percentage is high and you don't need to invest extreme amounts of time to check them.
I check usually all entries when i do such stuff because the autojoiners enter in waves, they login for example each 30 or 60 min. and you have then in the entries, very easy to spot, a bunch of them hitting the enter button in batches (a sign for multiaccounting if you question me but because they will not be suspended it is wasted time to dig into that too).
And when your BL is full you see clearer at which level you want to create public GAs in the future.
I am sure it will not be level 1 anymore :-D
Comment has been collapsed.
Never even considered that there might be a BL limit.
But yeah, level 1 is trivial to reach. I don't know why people still make level 0... I only do 1 or higher now, except maybe in groups/WL?
Thinking more about this, can't you solve 90% of this just by making the GAs level 2, or something similar? (not higher than level 4, please ;-)
Comment has been collapsed.
Sadly without a BL you don't solve it with a higher level.
I have always 1k in my BL (+ i am on ~500 BL) and still are only able to do level 5 public GAs without a high risk for winners that i want to report (but often can't).
I raised it over time more and more when i got more experiences with all the cheating. And nowadays i mostly do them for public GAs with level 5 to avoid negative experiences.
For my WL and my group i do always level 0 GAs.
But in the end each level higher sort out a part of the cheaters, abusers and exploiters.
Lvl 1 is better as 0, lvl 2 is better as 1 and so on.
So each step help.
You must decide for yourself how many "black sheep" you tolerate/are able to tolerate in your GAs.
I recommend you test a bit around with dif. levels and look at the results and if you have negative or positive experiences.
And then pick the one you feel most comfortable with, till you maybe decide different after X months/years.
Comment has been collapsed.
Food for thought, https://www.steamgifts.com/stats/community/active-users there were more active users with level 1 than level 0 (around 3000 0s vs 4000 1s) yesterday.
Interesting enough, level 2 drops, then it rises again to 2500 level 4s, then drops again.
Comment has been collapsed.
Wow. Though, any halfway intelligent bot-runner would bother to give away a single game and get into the level 1 tier.
I have to imagine they'll figure out how to bypass the anit-bot protections soon enough tho (FYI, zero knowledge on my part about what cloudflare does WRT to blocking bots).
Comment has been collapsed.
what cloudflare does WRT to blocking bots
Nothing.
If we speak about autojoiner bots.
The only ones that he could maybe stop/slow down with cloudflare are the ones that refresh the discussions very often to scan for new keydrops to claim them instantly.
Comment has been collapsed.
Just for the info. I had in last hours (not now) some problems with loading page. Currently everything works (not sure how long - i will update info later). I guess it can be related?
I use only old light script Extended Steamgifts (very barebone comparing to some gigantic scripts like ESGST which I dont use - it is helpful mainly for loading next page if you will move to the end of current page), Rechart Enchancer (for tables from deals as it is very useful to see fast which tgame you already have), SteamGifts - Group Info Hover (to fast check for which groups is group GA). Does it means it will be forbidden to use such scripts or the idea is to only eliminate bots and autojoiners?
Comment has been collapsed.
This is to stop ddos type attacks on the site. Scripts that use 3rd party sites to scrape information from SteamGifts will be affected. CG stated known script and sites should still work. This will not stop autojoiners or bots.
Comment has been collapsed.
My only suggestion would be to use a different service provider. Cloudflare has reliability issues. Anytime Cloudflare goes down steamgifts will not be available. Amazon CloudFront + AWS Shield Standard and Netlify seem good alternate and are free still.
Comment has been collapsed.
I've seen a few ERR_QUIC_PROTOCOL_ERROR yesterday and today in Chrome. I am guessing it's related to the change?
Comment has been collapsed.
Well, at least site rules don't forbid using VPN, so there's that. Without it, SG is now unavailable in Russia (meaning a huge part of SG users).
Comment has been collapsed.
is this a reference to a guy spaming about werewolfs?
Comment has been collapsed.
Yeah. The werewolf one is one of the funnier but also weird autojoin messages.
Comment has been collapsed.
I hope to win wthog
Is the "may your day be peachy, because ypu're a real BAMF" guy still around?
Comment has been collapsed.
Man., I haven't actually seen that one. Kinda wish I had though. Being called a BAMF is a nice confidence boost. :)
Comment has been collapsed.
So purely hypothetically speaking if you had to google the meaning of BAMF you are probably not a BAMF, huh?
Comment has been collapsed.
Hypothetically speaking, you might need some work to reach said status. But. It's attainable. :)
Comment has been collapsed.
this site loads sooo much faster now.
next how about a dark mode!!!!!
MY EYES STILL BURN!!!
Comment has been collapsed.
If you want dark mode so badly you could have had it for years.
https://imgur.com/a/7SWA2DI
Comment has been collapsed.
that lags the site, by about 0.5 seconds. when opening 50 pages every time i come back that time adds up
Comment has been collapsed.
Dark Reader extension for firefox! ...or chrome if that's your flavor.
Comment has been collapsed.
now this site is only accessible through a VPN for me
Comment has been collapsed.
For the last 5/10 minutes I've been constantly getting ERR_QUIC_PROTOCOL_ERROR. Don't know if it could be related but it seems so. Just in case it can help debug or improve the setup to solve the issues.
Comment has been collapsed.
I just had this error after longer time I though it is ok :).
Comment has been collapsed.
More like RIP Steamgifts browsing while I'm on my workplace. Maya said it got better with her work connection since the site is labeled Secure now, but for me as a Russian the browsing of SG while I'm on duty seemingly came to an end :(
Comment has been collapsed.
At first only cdn.steamgifts used a cloudflare and the user could refresh once steamgifts site via VPN and next use steamgifts from real ip and cdn.steamgifts from browser cache. Now You planned transfer all steamgifts in cloudflare, so for using site now eternal need use vpn.
Very bad changes((
steamdb also used cloudflare but on steamdb only cloudflare captcha and steamdb loads normally via real ip. Please make steamgifts as maked Pavel on steamdb.
Comment has been collapsed.
Did sg or steamtrades actually have problems with the type of attacks cloudflare blocks? I don't think we've even seen spam from a bot here, because they'd first have to register with a steam account with x value(I know we've had people make new accounts and spam their links but they weren't automated bots and no one could ever find those before they do it anyways).
Comment has been collapsed.
I believe the change here is to mostly aimed at stopping AI scrapers not specifically "autojoiners" or alt-accounters (cg can clarify if that's the case).
What people don't realize is just how much traffic these AI scrapers have been generating across the internet, most sites are being inundated with constant scraping non-stop, all those big AI companies are hungry for more data to train their models on, they are hitting the same pages over and over and over again. It's becoming a serious issue for anyone hosting public websites.
And to make things worse, they don't declare themselves like the usual web-crawlers or have any respect for the common control methods (robots.txt, etc), the traffic is usually coming from all over the world, so there is no specific IP segments one can easily filter...
Comment has been collapsed.
As an example, what stops x billionaire using AI to scrap the web? Cloudflare is not a gov organization nor is it a nonprofit with the interest of people, they're just a business. Someone can just walk up to cloudflare and make their case they're training their ai for "good purposes" and give cloudflare a payout to let their "researcher"(bot) through and we'll never know.
At the same time, someone with too much money can just figure out how to avoid cloudflare in the first place.
A company with an AI like deepmind, chatgpt, grok, claude, deepseek etc. for instance will scrape through cloudlfare like it doesn't even exist. They just make their scraper replicate human behavior.
I guess this works on very small time indie players with ai's no one will ever know about. It's interesting because they could literally just download another model data and build on it instead of starting from scratch. It's probably going to be an ongoing battle of who can bypass cloudflare fastest and eventually cloudflare will lose.
Looked it up and they are already partnered with a bunch of AI companies(https://www.cloudflare.com/partners/ai-partners/).
So this is likely to mitigate moltbook like websites and openclaw like users maybe. Less ai for the people, more for the corpos.
Comment has been collapsed.
figure out how to avoid cloudflare in the first place
there are existing solutions that do exactly that if you know where to look, but...
it's a cat and mouse game, cloudflare develops new sophisticated techniques to fingerprint user agents and tell users from bots apart, at the same time the "opposition" up their game and find ways to mimic real users, rinse and repeat...
it's a never ending cycle, but the point is, for site operators they don't have to worry about this whole can of worms, they can just outsource this problem to a company that specializes in this domain, especially with CF offering a lot of these services for free.
Comment has been collapsed.
Hi reigifts, yes, both sites are significantly impacted by bot traffic. SG receives millions of page views a day from bots. The situation on ST was growing rapidly throughout the past year, and I was seeing up to 95-99% of traffic coming from bots, in excess of 100 page views a second. That was quickly resolved with Cloudflare, to help reduce expenses and increase performance and stability.
If you read online, you'll see this isn't an unusual situation, and a lot of sites are seeing an increase in bot activity. I think ormax3 is right above, and most of it is due to online scrapers harvesting data for AI companies.
There are obviously other types of bots on SG. As mentioned, third-party scripts and add-ons people develop for the site. I'm going to be running tests to see how those are affected and if we can reduce traffic from any that don't follow our guidelines. I also see quite a few bots trying to ninja keys from discussions, and Cloudflare will greatly reduce those.
Comment has been collapsed.
Interesting, I guess I'm curious as to what these bots even want/gain from SG or ST? Are there bots that just scrape the web for 5-5-5 combinations attempting to find keys for absolutely anything and then they try them millions of times on every platform like if it's a windows key, a license key for some data recovery software, etc.? Or what do they gain from coming here when they can't even comment?
"I also see quite a few bots trying to ninja keys from discussions, and Cloudflare will greatly reduce those."I know there's a userscript extension that will scrape the page for hidden elements like a giveaway link hidden under a condensed link or something similar.
Also does this help you prevent any of the big players scraping sg? It's just my assumption but chatgpt and other popular ai's will scrape this and st whatever cloudflare says. (not that I think chatgpt has anything to gain by knowing x user on ST is trading x game for x tf2 keys).
I'm just confused as to why they'd scrape sg millions of times a day, when they can find open source github app's that use the steam api to do what websites like gg, steamdb etc do.
Comment has been collapsed.
Interesting, I guess I'm curious as to what these bots even want/gain from SG or ST?
They're desperate for data. Anything that can give AI tools a competitive advantage.
Are there bots that just scrape the web for 5-5-5 combinations attempting to find keys for absolutely anything and then they try them millions of times on every platform like if it's a windows key, a license key for some data recovery software, etc.?
The bots I see checking for keys are designed specifically for SG. They're viewing the popular key drop discussions for new comments.
Also does this help you prevent any of the big players scraping sg? It's just my assumption but chatgpt and other popular ai's will scrape this and st whatever cloudflare says.
Cloudflare offers quite a bit of control over which traffic you allow or block, and you can customize it for any of the major AI companies. That being said, with the amount of money involved in AI, I imagine they try to find other methods of collecting that data if they're blocked.
Comment has been collapsed.
Thanks for the insight.
I would've imagined it's a huge cost for these companies to scrape/store things that add much less value than designated sources like wikipedia/news websites/apis lets say. I'd also assume scraping random unofficial places would be unwanted in the trade since it could create inconsistencies in the model training since what's "true" or "false" might fade in the model. But I guess with all the government fomo funding they can afford to waste trillions.
"They're viewing the popular key drop discussions for new comments."I'm always 20 minutes late to those threads. I'm surprised those users even post keys directly in there anymore, even I thought at some point to use RSS or something on those threads but I mean my backlog is huge so I'm not that desperate xD.
Comment has been collapsed.
I think they're interested in how people talk to each other online, so they can make the chatbots more believable.
Comment has been collapsed.
I'm curious as to what these bots even want/gain from SG or ST?
they could care less about steam keys or hidden GA links, they want data, the very same text we are typing right now ;)
how do you think all the AI chatbots are trained? These models have an insatiable appetite for MORE data... In fact there's a certain scarcity happening atm as they are running out of sources of new data. Top internet sites with tons of user generated data (Reddit and the like) are starting to notice they are are sitting on a gold mine, and have moved to heavily block any form of automated access and in turn SELLING this data directly to AI companies for a good sum.
just the other day Anthropic came out out to declare they have detected large-scale "distillation attack" from other AI companies, which is hilarious that an AI company that stole everyone's data is now accusing other companies of siphoning theirs in return XD
Comment has been collapsed.
"how do you think all the AI chatbots are trained?"You're right, I just feel it's such a waste of data when there's open source models that already excel at responding better than the most intelligent human on Earth. I understand the need of them trying to stay relevant so grabbing new data. I guess I can see how there's also new players who are probably trying to start their own ai from scratch.
"just the other day Anthropic came out out to declare they have detected large-scale "distillation attack" from other AI companies, which is hilarious that an AI company that stole everyone's data is now accusing other companies of siphoning theirs""Rules for thee but not for me" attitude. Anthropic wants to be the only one who scraped the web on bio weapons and they're upset another ai learned how. Interesting read tho thanks xD.
https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks
All this and image generation still kinda sucks on AMD, and now Nvidia canceled the 6090 until like 2028. Maybe it is time to touch grass.
Comment has been collapsed.
Maybe it is time to touch grass.
Forget it, I must enjoy every minute my 4090 remains still the second fastest GPU three years past release. 😉
Comment has been collapsed.
Now this website doesn’t work for me without a VPN.
Comment has been collapsed.
Nice, thank you for all the work and improvements for site.
Comment has been collapsed.
Hi everyone,
I'm in the process of moving SG behind Cloudflare to help mitigate automated traffic and bots. I set up a similar change on SteamTrades a couple of weeks ago and it's been working quite well. I'm creating this discussion because I know there are a number of third-party tools and scripts people use for SG, and I want to try to ensure we find a way to keep the majority of those working. That might require whitelisting certain IP addresses from third-parties or allowing bots on specific pages. I'm going to keep a log of the changes that are taking place, and if you come across any issues related to these changes, please let me know in the comments.
If you run a service that is scraping SG and needs legitimate access to the site, please create a ticket with a brief explanation of the script or service, along with the IP address, and I'll try to get it whitelisted.
March 6
February 27
February 26
February 23
Comment has been collapsed.