Author Topic: [Important Notice] So what happened?  (Read 980 times)

Offline Starfox

  • Master Keeper
  • Totally Awesome Member - Won A Cookie!
  • *****
  • Posts: 2462
  • Did anybody see my lenses?
    • The Foxhole
[Important Notice] So what happened?
« on: April 08, 2016, 04:45:52 AM »
As people trying to visit the site yesterday have noticed, we had a big unplanned interruption of service. It appears that a number of bots hammered the main site from multiple IPs trying to connect to accounts that no longer exist (accounts never served anything on the main Foxhole site aside from administrative ones but obviously bots can't read notices). This was I assumed, and after tracking the problem, a major delayed spam attack (meaning bots create fake accounts then let them sleep without activity sometime for years then suddenly one day they try to connect and post spam crap trying to take administrators by surprise).

But yesterday instead they took down the site because they roughly attempted to log several thousands times in a span of a few hours and the plan I have with our host does include a maximum account execution (the number of scripts one can run -- login to a site makes at least one and generally more) of 10000 per day which is more than enough for our normal needs but obviously not enough in case of a general attack (in fact no plan including a usage limit is enough in case of attack). Our host waited for the usage to reach 15000 -- or 150% of our allowance -- before closing things down for 24 hours.

I've taken steps to try to not have this happen again. But obviously there's no guarantee in life.

I also had to password protect access at server level the time of my investigations. Sorry for the inconvenience but that was needed because of the risk of having the problem continuing before I could do anything to prevent it.

I may have to take down the main site again during the next days depending on how the situation goes, so don't be panicked if that happens.

For those of you who'd fear to see the site simply vanish, it won't be the case (not right now anyway). The site is paid for until December 2017. Yesterday problem was quite out of the blue.
« Last Edit: April 08, 2016, 06:13:07 AM by Starfox »


Imagination is more important than knowledge. Knowledge is limited. Imagination encircles the world. -- A. Einstein

Offline bobdog

  • Totally Awesome Member - Won A Cookie!
  • ******
  • Posts: 3408
  • Avatar of Curiousness
Re: [Important Notice] So what happened?
« Reply #1 on: April 08, 2016, 06:16:45 AM »
Well, i was hoping you hadn't died or something, but I figured it was just temporary maintenance. Darn those spambots!!   :computerfix:

Offline Silver Sorrow

  • Forums Keeper
  • Totally Awesome Member - Won A Cookie!
  • *****
  • Posts: 2943
  • Avatar of Wrongeousness
Re: [Important Notice] So what happened?
« Reply #2 on: April 08, 2016, 08:43:29 AM »
*feeling pulse*

*shaky laugh*

...well...things like this just let you know you're alive, right?

:ss-ahhhh
An interview with Kim Kardashian? Who wants to see that? I'd rather see an interview with the mortician's assistant who had to piece her head back together so they could have an open-casket funeral.

Offline Lord Mantrid

  • Hero Member
  • *****
  • Posts: 556
  • Sorry, you startled me. I was doing Snorkel Shots.
Re: [Important Notice] So what happened?
« Reply #3 on: April 08, 2016, 08:51:47 AM »
I'm just gonna throw out a "Thanks, Obama" for old times sake
Spoiler
valv softwer is 3d relms in teh futuer!!!!!!111!1!1one1!

Offline Starfox

  • Master Keeper
  • Totally Awesome Member - Won A Cookie!
  • *****
  • Posts: 2462
  • Did anybody see my lenses?
    • The Foxhole
Re: [Important Notice] So what happened?
« Reply #4 on: April 08, 2016, 10:26:19 AM »
When I checked the server this morning I had an error log for the main site of... 8 MB to contemplate, 99% of which where "Failed Login. Account does not exist." from an impressive number of different IPs the whole thing in just a few hours. If we were an important controversial site and considering the number of IPs involved I'd say that this was a DDOS attack, but who would want to do that to us? That would be very stupid there's nothing to gain bringing down a site of our dimension. On the other hand it's troubling to see that spam bots now use this kind of war tactics just to post ads.

The whole thing is quite interesting... It started...

2016-04-06   00:03:10  CDT -- One IP try to log in and get an "account does not exist" error
2016-04-06   01:08:43  -- The same IP come back for more of the same (that's when you see this is a bot... A human would have been intelligent enough to get it the first time)
2016-04-06   02:14:45 -- The same IP again... As you notice though this is very quiet with one hour between each attempt.

The same thing goes on with about one try every hour until someone clearly lost their temper...

2016-04-06   11:58:59 -- another IP try to connect 3 times within 1 second.
2016-04-06   11:59:41 -- yet another IP, 3 times 1 seconds

And that goes on and on accelerating even, until our host finally closed the pipe on 2016-04-07   at 08:02:49 during this time almost 42,000 attempts have been made.

Most IPs in my log are from Russia and Ukraine. And there are a lot of them... What is it with those countries? Did they turn spam into an industry? Wait, I know the answer, they did... As a matter of fact they're currently ranked #3 and 5 of the worst spamming countries.

Don't laugh though because USA is #1

Someday politicians will have to get involved... It's been years and years we say spam is a major problem.  We have to deal with an internet where 80% of the mail traffic is spam for God sake. Yet, nobody finds something wrong with this number? Think of all the bandwidth that could be used for more interesting things, the web bottlenecks that would be avoided with that much less spam.

But sure, there's the rub: it may be spam but it eats bandwidth and bandwidth is paid for at some point... So obviously even the spam traffic benefits to some people. So since there's money to be made why change things?


Imagination is more important than knowledge. Knowledge is limited. Imagination encircles the world. -- A. Einstein

 

everything