Forum works again , somewhat , yaaaaaaay

That is a misconception. Any bot that does not solve javascript can be kicked out in a second. There is quite a lot of extra configuration needed in Nginx and Anubis itself to quickly cut all ties with bots, or they will consume your resources by hanging around indefinitely. For most of the attack we had 80K open (hanging) TCP connections, it is now several thousand (basically: the attack rate). Note that CloudFlare works roughly the same way, but we're not throwing money their way for the occasional slow day.
 
Anubis works fine as a first line of defense. The main objective was to build a dam between the front door (nginx, very lightweight) and the much heavier intermediary (php) and backend (mysql) processes. Before implementing Anubis, every bot triggered the full nginx +php + mysql pipeline by requesting a page and immediately leaving, causing a half-open connection hanging around for a long time, with php and mysql still forming a full response in the meantime. By putting anubis right behind nginx and by implementing very short timeouts on that pipeline, these bots just bounce off of a hardwood front door. Yes, the attack rate has an impact on response times because they are tying up some nginx workers and some anubis cycles (serving riddles), but the attack in itself has no merit, hardly any effect and whoever orchestrates it will soon get tired of wasting their own resources whilst seeing the Forums up and running.
 
For Sorry , i have no idea


Why? Pretty simple

Hate , someone doing this because they can or testing on weaker target first to test their "ddos script" (applies to script kiddies) that is my guess
Often just nothing better to do. I'm online chess player. It's hard to imagine how many players run Chessmaster in a 2nd window to feel fake victorious over a random internet opponent.

Someone tried to find a common signature in the source ip's? There are chances, depending on how advanced the attacker is.
 
Al
Often just nothing better to do. I'm online chess player. It's hard to imagine how many players run Chessmaster in a 2nd window to feel fake victorious over a random internet opponent.

Someone tried to find a common signature in the source ip's? There are chances, depending on how advanced the attacker is.
Chances are that if they are able to get an accurate source IP that it's in Russia or some other country that doesn't generally prosecute for cybercrimes targeting people in other countries.

Personally, I have to appreciate that at least the anti-bot software being used isn't that stupid captcha stuff that mostly serves to keep autistic people out.
 
There are no patterns in a DDoS. All IP addresses belong to trojaned equipment whose owners have no idea that their 'smart' washing machine or their outdated phone is being operated from a botnet Command & Control server. You will easily find 100,000+ IP addresses in a run like this, and all you can do is either go offline or stage the best defense you can under the circumstances.
 
There are no patterns in a DDoS. All IP addresses belong to trojaned equipment whose owners have no idea that their 'smart' washing machine or their outdated phone is being operated from a botnet Command & Control server. You will easily find 100,000+ IP addresses in a run like this, and all you can do is either go offline or stage the best defense you can under the circumstances.
So sad that this happened to the forum , anyway thanks for amazing work you do and other mods here.
 
Al

Chances are that if they are able to get an accurate source IP that it's in Russia or some other country that doesn't generally prosecute for cybercrimes targeting people in other countries.

Personally, I have to appreciate that at least the anti-bot software being used isn't that stupid captcha stuff that mostly serves to keep autistic people out.
It seems over again. The botchecker works pretty good. Looks like validated real ip's get priority but the server still has to take the incoming traffic too far because it all looks the same.
It feels offensive. I would take a sample of some ddos ips and some real users, try to find a dividing difference and drop the bad ones before going to request processing. 🤬
 
That is a misconception. Any bot that does not solve javascript can be kicked out in a second. There is quite a lot of extra configuration needed in Nginx and Anubis itself to quickly cut all ties with bots, or they will consume your resources by hanging around indefinitely. For most of the attack we had 80K open (hanging) TCP connections, it is now several thousand (basically: the attack rate). Note that CloudFlare works roughly the same way, but we're not throwing money their way for the occasional slow day.
We appreciate you, homie.
 
There are no patterns in a DDoS. All IP addresses belong to trojaned equipment whose owners have no idea that their 'smart' washing machine or their outdated phone is being operated from a botnet Command & Control server. You will easily find 100,000+ IP addresses in a run like this, and all you can do is either go offline or stage the best defense you can under the circumstances.
I have a number of routers from my local Salvation Army that appear to be original. However, once you connect to the ROM chip, you can see they are ready to phone home (and do). I'm waiting to find more.
 
Chances are that if they are able to get an accurate source IP that it's in Russia or some other country that doesn't generally prosecute for cybercrimes targeting people in other countries.
If we’re talking about state-sponsored criminal groups (which are unlikely to bother with this FreeBSD forum), then yes. But they only handle serious operations, since they are funded by state budgets—and we’re talking about huge sums of money. Besides, such groups keep a low profile and certainly aren't amateurs. This isn't just the stuff of legend, though—they do get put on wanted lists sometimes. What other countries do you know of? :)))
A single attack can cost tens of thousands of dollars.
 
It works but not as before. On the pictures is the start with Firefox with some tweeking but with default Firefox is the same. Also with Waterfox.
When I reload the page users shows icons.
forum.gif



forum.gif
users.gif
 
Back
Top