Anonymous
7/3/2025, 6:14:45 PM No.18147965
>THE PROBLEM
>At some point in May, the traffic to our website increased tenfold within a few days. Until then, our daily number of visits from unique IP addresses (mostly people, many search and AI bots) was in the 200,000 range with total number of hits (pages accessed) in the 5-6 million range. On May 31, the number of visits had climbed up to 1.6 million, but the hits remained somewhat steady between 6-7 million. This means that those additional 1.5 million visits were not actual users, but bots and other bad actors repeatedly hitting our server with access requests. Not just one IP either, but thousands of new IP addresses ("DDOS", Distributed Denial of Service).
>This increased traffic proved to be too much for our single server, at which point a cascade of individual problems happened. These issues repeatedly occurred whenever load spikes where happening again and again:
>- Server logs filled up the root partition on the server, resulting in no more disk space available for essential services (e.g. cronjobs).
>- Flood protection thresholds at our hoster were triggered repeatedly, shutting down email and caching services, affecting core features of the site.
>- Website performance due to the high server load at some points was impacted so dramatically that many users only got 503 permission response codes when trying to access
THE CAUSE
>At this point the origin of the attacks and their motivation is still entirely unclear.
>However, now that we know more about those attacks and what kind of havoc they caused, we have a better understanding of the attack vectors and how we can (hopefully) contain those threats.
https://www.cagematch.net/?id=555&nr=2770
>At some point in May, the traffic to our website increased tenfold within a few days. Until then, our daily number of visits from unique IP addresses (mostly people, many search and AI bots) was in the 200,000 range with total number of hits (pages accessed) in the 5-6 million range. On May 31, the number of visits had climbed up to 1.6 million, but the hits remained somewhat steady between 6-7 million. This means that those additional 1.5 million visits were not actual users, but bots and other bad actors repeatedly hitting our server with access requests. Not just one IP either, but thousands of new IP addresses ("DDOS", Distributed Denial of Service).
>This increased traffic proved to be too much for our single server, at which point a cascade of individual problems happened. These issues repeatedly occurred whenever load spikes where happening again and again:
>- Server logs filled up the root partition on the server, resulting in no more disk space available for essential services (e.g. cronjobs).
>- Flood protection thresholds at our hoster were triggered repeatedly, shutting down email and caching services, affecting core features of the site.
>- Website performance due to the high server load at some points was impacted so dramatically that many users only got 503 permission response codes when trying to access
THE CAUSE
>At this point the origin of the attacks and their motivation is still entirely unclear.
>However, now that we know more about those attacks and what kind of havoc they caused, we have a better understanding of the attack vectors and how we can (hopefully) contain those threats.
https://www.cagematch.net/?id=555&nr=2770
Replies:
