We're drowning in lurkers

[theGinsue]

Yeah, my guess is a real weak sauce DDOS attempt by some script kiddie with a real lame bot-net.

I saw Ginsue cruise through a little bit ago. Admins be fixin.

I alerted J on this earlier and he tweaked the firewall a bit, but it was an attempt at a DDoS using Chinese bots coming through US provider with multiple weaknesses. I see spam accounts coming trough the same provider often and have tried to block those IP subnets, but that provider has a LOT of them.

Just got off of the phone with J and, as you can see, he seems to have tweaked the firewall enough to block most, if not all of the subnets. He's going to shoot me a list of the blocked subnets so I can run it against the forum to see if this will affect any of our members. We'll adjust as needed.

This thread was a good idea, but always remember that the quickest way to reach the staff is by using the "Report" icon.

[argonstrom]

I alerted J on this earlier and he tweaked the firewall a bit, but it was an attempt at a DDoS using Chinese bots coming through US provider with multiple weaknesses. I see spam accounts coming trough the same provider often and have tried to block those IP subnets, but that provider has a LOT of them.

Just got off of the phone with J and, as you can see, he seems to have tweaked the firewall enough to block most, if not all of the subnets. He's going to shoot me a list of the blocked subnets so I can run it against the forum to see if this will affect any of our members. We'll adjust as needed.

This thread was a good idea, but always remember that the quickest way to reach the staff is by using the "Report" icon.

Thanks, Ginsue & J - you guys rock!

[J]

I've been fighting with this a good bit this afternoon/evening. It might continue to be a bumpy ride for a bit, until our attacker gets a tired of his hijinx.

It seems that someone has found a vulnerability in a large colocation provider. We have received several moderate level DoS attacks at various times today. Unfortunately, the provider that has been compromised has many servers, over almost a dozen locations, so it has been difficult to lock that host out of the firewall entirely in a preventative process. Like many CoLo providers, they have acquired sporadic/random class Bs and Cs from their upstream (and LARGE) ISPs as needed, that would lock out many members with a wide scale rule in the firewall.

We have been locking out individual class C subnets reactively as attacks present themselves. I am also contracting this provider with what data I have, in hopes they can assist. Unfortunately, it probably isn't servers directly administered by this provider, but those of a client that rents space from them.

Hopefully it starts performing better with the newest round of firewall drop rules.

[hghclsswhitetrsh]

Thanks, Ginsue & J - you guys rock!

+1

[theGinsue]

J did the work, I just gawked. (Window licker sort of thing)

[sniper7]

Much faster now!

please send the attackers an attack of gay porn if possible to let them know our displeasure of their actions.

[hurley842002]

Much better, thanks J and everyone else involved.

[HoneyBadger]

Thanks J, Much better now.


Maybe this is a good opportunity to remind everyone that this is a FREE forum with NO BANNER ADS. Maybe we can express our thanks to J and others with a nice "thank you" gift of some sort.

J, Ginsue, other Mods/Admins: who pays for the hardware (servers and such) as well as other miscellaneous expenses to keep the site running? Can we donate directly to this person(s) via paypal or similar means?

[OtterbatHellcat]

Thanks, Ginsue & J - you guys rock!

Plus 1

Thanks J, Much better now.


Maybe this is a good opportunity to remind everyone that this is a FREE forum with NO BANNER ADS. Maybe we can express our thanks to J and others with a nice "thank you" gift of some sort.

J, Ginsue, other Mods/Admins: who pays for the hardware (servers and such) as well as other miscellaneous expenses to keep the site running? Can we donate directly to this person(s) via paypal or similar means?

I've brought this up before.....about donating to the contribution thread list..thingy.

You'd think I'd have told every member they were going to get a pay cut in their salary for a year. Deaf ears, HB.

I should kick a buck though, it's been a bit.

[Irving]

Thank you guys.