Unable to access fb.net forums
Re: Unable to access fb.net forums
It's still strange this variation in the total number of online users of about +/-200 in a few minutes:
humans or robots for the most part?
Response time to access a post between 1 and 20 seconds depending on the moment (around 16:00, French time, I had very long access times).
humans or robots for the most part?
Response time to access a post between 1 and 20 seconds depending on the moment (around 16:00, French time, I had very long access times).
-
- Posts: 4310
- Joined: Jan 02, 2017 0:34
- Location: UK
- Contact:
Re: Unable to access fb.net forums
I don't think that we have a DDOS attack - botnets are usually much larger, my guess is an attack from a singe computer.
StatCounter have a 30-day free trial. I am not sure that it would be much help, but we have nothing to lose by giving it a go.
StatCounter have a 30-day free trial. I am not sure that it would be much help, but we have nothing to lose by giving it a go.
Re: Unable to access fb.net forums
A short technical analysis (so far), on Server Error 500 (Internal Server Error):
NOT a typical DDoS/DoS because, those typically attack the low level I/O system, of the Server.
Proof:
The attack/problem is most likely on the Application level. Both forum and wiki are affected.
Additional observation:
Last working week (before the week end) the SQL-server experienced a problem, too.
Both forum and wiki where unreachable (503 Server Error 'SQL'):
NOT a typical DDoS/DoS because, those typically attack the low level I/O system, of the Server.
Proof:
- Ping statistics didn't change notably (about 150 mS, here)
- Home Page (freebasic.net/default.*) loaded, as fast as ever
The attack/problem is most likely on the Application level. Both forum and wiki are affected.
Additional observation:
Last working week (before the week end) the SQL-server experienced a problem, too.
Both forum and wiki where unreachable (503 Server Error 'SQL'):
Re: Unable to access fb.net forums
The only things that comes in my mind is perhaps some user that got banned and is looking for revenge, or some wannabe cracker that is trying his attack on what he considers an easy target.deltarho[1859] wrote:This sounds like a DOS attack but I doubt that cyber-criminals are involved otherwise they would have brought the site down in August with a demand for a bitcoin payment and there are better targets than peer support forums where the product is free.
-
- Posts: 4310
- Joined: Jan 02, 2017 0:34
- Location: UK
- Contact:
Re: Unable to access fb.net forums
I use 'Tab Auto Refresh' in Firefox. If I am in conversation with someone I don't wait to get emails I set the refresh rate to 60 seconds. When the conversation is over I set the refresh rate to zero.
I set the refresh rate to 5 seconds and noted the 'In total there are <nnn> users online' value and got this on a few following refreshes.
759
764
770
773
780
783
787
797
The total increased by at least three for each refresh.
I had another go and got this:
495
499
507
512
528
550
577
I don't believe those figures but what are they telling us?
I wouldn't have thought a DOS attack would behave like that.
A server reboot might help. <grasping at straws>
I set the refresh rate to 5 seconds and noted the 'In total there are <nnn> users online' value and got this on a few following refreshes.
759
764
770
773
780
783
787
797
The total increased by at least three for each refresh.
I had another go and got this:
495
499
507
512
528
550
577
I don't believe those figures but what are they telling us?
I wouldn't have thought a DOS attack would behave like that.
A server reboot might help. <grasping at straws>
Re: Unable to access fb.net forums
The guests are spread roughly evenly through the 13 threads.
It wouldn't be too hard to set up a computer to constantly call each of these addresses in a loop, text only internet calls perhaps, then kill these calls in a cycle.
It could be one person.
But they are very persistent (months now), which seems to suggest otherwise.
It wouldn't be too hard to set up a computer to constantly call each of these addresses in a loop, text only internet calls perhaps, then kill these calls in a cycle.
It could be one person.
But they are very persistent (months now), which seems to suggest otherwise.
Re: Unable to access fb.net forums
As said in another thread, since august forum spammers have been particularly busy. At FPC we had also problems (early august), but we use SMF.
If FB has somehow customized the registration process, it might be that the bots simply fail to register, but still are trying and doing their rounds. Or maybe they are enumerating profiles to see if they contain hints for pwds (but that would also yield bulks of failed logins)
IIRC one of the admins polished our fail2ban ban filter install for this, and made some custom bans like loading a certain page too often.
If FB has somehow customized the registration process, it might be that the bots simply fail to register, but still are trying and doing their rounds. Or maybe they are enumerating profiles to see if they contain hints for pwds (but that would also yield bulks of failed logins)
IIRC one of the admins polished our fail2ban ban filter install for this, and made some custom bans like loading a certain page too often.
-
- Posts: 4310
- Joined: Jan 02, 2017 0:34
- Location: UK
- Contact:
Re: Unable to access fb.net forums
Who hosts freebasic.net?
-
- Posts: 4310
- Joined: Jan 02, 2017 0:34
- Location: UK
- Contact:
Re: Unable to access fb.net forums
I have just tried my 'Tab Auto Refresh' again, every five seconds, and got
47
47
47
48
48
49
51
52
53
54
56
The question is: Who has done what?
47
47
47
48
48
49
51
52
53
54
56
The question is: Who has done what?
-
- Posts: 4310
- Joined: Jan 02, 2017 0:34
- Location: UK
- Contact:
Re: Unable to access fb.net forums
It has started again.
318
329
354
380
404
422
439
451
462
478
487
It started again bang on 10 am - I'm in the UK. Application issue? Maybe not. A single computer in the US, which was turned off overnight, maybe.
Added: Block US IP addresses for 10 minutes and see what happens.
Scrub that. I use a VPN and my IPv4 is not where I am, so our 'friend' could be in the far east using a US IP. So, what does 10 am tell us now? <grasping at straws again>.
318
329
354
380
404
422
439
451
462
478
487
It started again bang on 10 am - I'm in the UK. Application issue? Maybe not. A single computer in the US, which was turned off overnight, maybe.
Added: Block US IP addresses for 10 minutes and see what happens.
Scrub that. I use a VPN and my IPv4 is not where I am, so our 'friend' could be in the far east using a US IP. So, what does 10 am tell us now? <grasping at straws again>.
Re: Unable to access fb.net forums
Only the number of Registered+Hidden users are members that have actually logged in. The number of guests are the number of unique IP's seen and can't be trusted to be anything meaningful. 100+ unique IP's every minute, creating dozens of page requests every second. I'm reluctant to report what I know about the attacker or what the counter measure plan is here in the open because last thing I want to do is give the attacker pointers for improvement.
-
- Posts: 4310
- Joined: Jan 02, 2017 0:34
- Location: UK
- Contact:
Re: Unable to access fb.net forums
The figures have dropped again and are fairly steady. Someone is reading this thread and is now 'taking the mickey'.
No one will argue with that and I will stop 'playing around' - good luck.I'm reluctant to report what I know about the attacker or what the counter measure plan is here in the open
Re: Unable to access fb.net forums
Hey, I am a registered user!!!No registered users and 35 guests
Re: Unable to access fb.net forums
The community board at phpBB (itself) also a large number of visitors recently (August).
With a maximum of 27085 users online, but with a 90 minute window.
https://www.phpbb.com/community/viewtopic.php?t=2524746
With a maximum of 27085 users online, but with a 90 minute window.
https://www.phpbb.com/community/viewtopic.php?t=2524746
-
- Posts: 538
- Joined: Dec 02, 2011 22:51
- Location: France
Re: Unable to access fb.net forums
@coderJeff : sounds as a good job. I like "our" Fb forum. Thank you. :-)