Post: #1

An individual or group has been targeting RVF since Friday night. Here's what I know:

1. He is using a dedicated server over at http://www.psychz.net/ to launch a DDOS attack from a single IP address. In one day, he initiated over 130,000 connections. The traffic seems to mirror normal traffic so the forum software thinks it's a legitimate user, though at the same time it doesn't count on the "Who's Online" stat.

2. The attack has been too small to cause major disruption to the server (we're on a server that is much larger than our needs), but you may have noticed intermittent slowness since Friday.

3. After banning one IP address, the attacker moved to a second IP on the same node. Psychz.net has been contacted that their service is being abused and my host is helping me to prevent further disruption. Here's how the attack looks like:



As you see, there is a large number of connections coming from the last IP, which belings to Psychz.net. (The second-to-last IP is from Ukraine, which looks suspicious).

As of right now, the server is not experiencing any problems, but I expect the attacker to continue this. No one has claimed responsibility for the attack and as we have many enemies, I have no idea who is behind it.

This is a sensitive time for us, so Tuth and I will take zero tolerance on those starting bullshit threads or engaging in subtle trolling (read Tuth's announcement). Things that would normally result in a temporary suspension may get a ban. Keep it clean.

Post: #2

This sounds like the "anonymous" kids

Post: #3

(05-25-2014 10:02 AM)TonySandos Wrote:  This sounds like the "anonymous" kids

Doubt it. Anonymous is way more competent in taking down sites than this weak effort. I think it's one disgruntled PUAhater.

Post: #4

I agree that they would be expected to do better. I did explore their structure a while back when I was interested in their movement. They have fringe elements of their own and what could best be referred to as cells, single or very few users which perform small scale operations. They have a strong connection to the lgbt community(one of their main leaders is a lesbian).

I don't know much about website infrastructure, but it better to plan against them. In less then 24 hours the media already lumped this community in the guilty verdict. Be careful man

Post: #5

A single-host attack is technically not a DDoS...

In any case, this is pretty weak. Don't sweat it.

Post: #6

Do you have rate limiting set up in the web server? If this isn't affecting the site too much, might not be worth implementing.

Post: #7

(05-25-2014 12:41 PM)ryanf Wrote:  Do you have rate limiting set up in the web server? If this isn't affecting the site too much, might not be worth implementing.

I always thought a limit on the number of parallel connections per IP is standard on every website?

Post: #8

You might want to consider setting up Cloudflare for your sites. Cloudflare goes in between the Internet and your server and can quickly shutdown an attack. I plan to be using it for my new sites.

Post: #9

This could equally be the work of a PUAHate electronic terrorist or a random white knight with computing skills.

They've been especially active in the past couple of days:

   

Post: #10

(05-25-2014 01:38 PM)Tuthmosis Wrote:  This could equally be the work of a PUAHate electronic terrorist or a random white knight with computing skills.

They've been especially active in the past couple of days:

How dare you post that shit?
WOW, just WOW

Post: #11

(05-25-2014 09:53 AM)Roosh Wrote:  An individual or group has been targeting RVF since Friday night. Here's what I know:

1. He is using a dedicated server over at http://www.psychz.net/ to launch a DDOS attack from a single IP address. In one day, he initiated over 130,000 connections. The traffic seems to mirror normal traffic so the forum software thinks it's a legitimate user, though at the same time it doesn't count on the "Who's Online" stat.

2. The attack has been too small to cause major disruption to the server (we're on a server that is much larger than our needs), but you may have noticed intermittent slowness since Friday.

3. After banning one IP address, the attacker moved to a second IP on the same node. Psychz.net has been contacted that their service is being abused and my host is helping me to prevent further disruption. Here's how the attack looks like:



As you see, there is a large number of connections coming from the last IP, which belings to Psychz.net. (The second-to-last IP is from Ukraine, which looks suspicious).

As of right now, the server is not experiencing any problems, but I expect the attacker to continue this. No one has claimed responsibility for the attack and as we have many enemies, I have no idea who is behind it.

This is a sensitive time for us, so Tuth and I will take zero tolerance on those starting bullshit threads or engaging in subtle trolling (read Tuth's announcement). Things that would normally result in a temporary suspension may get a ban. Keep it clean.

I'd have advised you use Cloudflare or something better but I'm guessing you've already done that...If not this Forum would not be standing today with the amount of hate coming from the outside...
Anyway, I just read an article on slate about the Elliot case where you were mentioned .

Post: #12

Sounds like the puahate trolls have a little too much time on their hands with their website down.

Beyond All Seas

"The individual has always had to struggle to keep from being overwhelmed by the tribe.
To be your own man is a hard business. If you try it, you'll be lonely often, and sometimes
frightened. But no price is too high to pay for the privilege of owning yourself." - Kipling

Post: #13

(05-25-2014 01:09 PM)username Wrote:  You might want to consider setting up Cloudflare for your sites. Cloudflare goes in between the Internet and your server and can quickly shutdown an attack. I plan to be using it for my new sites.

I'll second Cloudflare. They had some uptime issues a couple of years ago but touch wood have been ok since.

Post: #14

It came from Ukraine? I would think the people there have something better to do than care about hating this site.

Post: #15

(05-26-2014 05:47 AM)Foolsgo1d Wrote:  It came from Ukraine? I would think the people there have something better to do than care about hating this site.

It's most likely a proxy. Why would Ukrainians bother wasting their time on us? They are too smart for that. On the other hand, the fat American has more a bone to pick.