Unable to access fb.net forums

[fxm]

It's still strange this variation in the total number of online users of about +/-200 in a few minutes:
humans or robots for the most part?

Response time to access a post between 1 and 20 seconds depending on the moment (around 16:00, French time, I had very long access times).

[deltarho[1859]]

I don't think that we have a DDOS attack - botnets are usually much larger, my guess is an attack from a singe computer.

StatCounter have a 30-day free trial. I am not sure that it would be much help, but we have nothing to lose by giving it a go.

[MrSwiss]

A short technical analysis (so far), on Server Error 500 (Internal Server Error):
NOT a typical DDoS/DoS because, those typically attack the low level I/O system, of the Server.

Proof:

• Ping statistics didn't change notably (about 150 mS, here)
• Home Page (freebasic.net/default.*) loaded, as fast as ever

Therefore, Imortis seems to be on the right track.
The attack/problem is most likely on the Application level. Both forum and wiki are affected.

Additional observation:
Last working week (before the week end) the SQL-server experienced a problem, too.
Both forum and wiki where unreachable (503 Server Error 'SQL'):

[angros47]

This sounds like a DOS attack but I doubt that cyber-criminals are involved otherwise they would have brought the site down in August with a demand for a bitcoin payment and there are better targets than peer support forums where the product is free.

The only things that comes in my mind is perhaps some user that got banned and is looking for revenge, or some wannabe cracker that is trying his attack on what he considers an easy target.

[deltarho[1859]]

I use 'Tab Auto Refresh' in Firefox. If I am in conversation with someone I don't wait to get emails I set the refresh rate to 60 seconds. When the conversation is over I set the refresh rate to zero.

I set the refresh rate to 5 seconds and noted the 'In total there are <nnn> users online' value and got this on a few following refreshes.

759
764
770
773
780
783
787
797

The total increased by at least three for each refresh.

I had another go and got this:

495
499
507
512
528
550
577

I don't believe those figures but what are they telling us?

I wouldn't have thought a DOS attack would behave like that.

A server reboot might help. <grasping at straws>

[dodicat]

The guests are spread roughly evenly through the 13 threads.
It wouldn't be too hard to set up a computer to constantly call each of these addresses in a loop, text only internet calls perhaps, then kill these calls in a cycle.
It could be one person.
But they are very persistent (months now), which seems to suggest otherwise.

[marcov]

As said in another thread, since august forum spammers have been particularly busy. At FPC we had also problems (early august), but we use SMF.

If FB has somehow customized the registration process, it might be that the bots simply fail to register, but still are trying and doing their rounds. Or maybe they are enumerating profiles to see if they contain hints for pwds (but that would also yield bulks of failed logins)

IIRC one of the admins polished our fail2ban ban filter install for this, and made some custom bans like loading a certain page too often.

[deltarho[1859]]

Who hosts freebasic.net?

[deltarho[1859]]

I have just tried my 'Tab Auto Refresh' again, every five seconds, and got

47
47
47
48
48
49
51
52
53
54
56



The question is: Who has done what?

[deltarho[1859]]

It has started again.

318
329
354
380
404
422
439
451
462
478
487

It started again bang on 10 am - I'm in the UK. Application issue? Maybe not. A single computer in the US, which was turned off overnight, maybe.

Added: Block US IP addresses for 10 minutes and see what happens.

Scrub that. I use a VPN and my IPv4 is not where I am, so our 'friend' could be in the far east using a US IP. So, what does 10 am tell us now? <grasping at straws again>.

[coderJeff]

Only the number of Registered+Hidden users are members that have actually logged in. The number of guests are the number of unique IP's seen and can't be trusted to be anything meaningful. 100+ unique IP's every minute, creating dozens of page requests every second. I'm reluctant to report what I know about the attacker or what the counter measure plan is here in the open because last thing I want to do is give the attacker pointers for improvement.

[deltarho[1859]]

The figures have dropped again and are fairly steady. Someone is reading this thread and is now 'taking the mickey'.

I'm reluctant to report what I know about the attacker or what the counter measure plan is here in the open

No one will argue with that and I will stop 'playing around' - good luck.

[jj2007]

No registered users and 35 guests

Hey, I am a registered user!!!

[badidea]

The community board at phpBB (itself) also a large number of visitors recently (August).
With a maximum of 27085 users online, but with a 90 minute window.
https://www.phpbb.com/community/viewtopic.php?t=2524746

[Lost Zergling]

@coderJeff : sounds as a good job. I like "our" Fb forum. Thank you. :-)