[MERGED] Site Slow/Down - DDoS Attack (Resolved)

[UnlimitedMB]

Sorry for the server slowness.

There is a DDoS attack against the server coming from multiple IP's.
We have now written a script to auto ban the attacking ip's on the firewall but it still takes a few seconds.

The attacks are against the IP so we dont know the actual site being targetted, we know its a free hosting domain.

As soon as we find the domain we will remove it and service will be back to normal.

[zidian]

Thnk U So Much!

[UnlimitedMB]

We are sucessfully blocking the attack now.
This was a difficult one, every time we blocked attacker IP's more came.

[wwe]

Hmm... one of my subdomains doesn't work now lol

The sites and other subdomains work but one doesn't. Well I hope you get things settled out :)

[Tyler]

Server is quick for me now.

[UnlimitedMB]

What subdomain does not work?
If you are able to access the server at all everything should be working, not partially.

[wwe]

Oh it's working now o_O...

At first I checked everything I had and both domains showed up just fine and two out of three subdomains showed up fine. The other one showed a "Server Not Found" message for a while but it's working now :)

[backdoor]

Are they attacking users too?

I am getting wtf pwned as well :(

[Victor01469]

They are trying to ultimately attack ULMB, to get someones site down. I don't know what the reasoning is behind it, but with the script Eric set up, it should prevent attacks for lasting more than a few seconds. Things should now be back to normal.

[funpkingv2]

Its prob cuz of DNS but the site was working great last night

funpking.info is not loading

but funpkingv2.ulmb.com is..

[wwe]

It's loading just fine for me... o.O

Maybe there's something up with your connection? As I recall you had the same issue about a day or two ago. Same site and only you.

[funpkingv2]

yea but this time iv tried 2 different computers

and then another at a friends house

and every now and then the homepage will load but nothing else on the site..

[UnlimitedMB]

your ip is banned from the firewall for making excessive connections (more then 10 simultaneous) to the server.

we have to do this to block the ddos attacks
you probably have one of those browser modifications which hammers webservers with connections to download faster

[kaipie]

I'm having the same problem.

I think it is my school. There are serveral people that use the site and it wont let them access the pages.

~Kai~

[vnemesis]

my websites still down/slow:

vnemesis.com
rf-tranquility.com


thnx

[Victor01469]

If ULMB lifts the restrictions, we will end up with the server slow-downs once again. For now, please deal with the issue until something is figured out.

[Victor01469]

Your websites are up, and have been up, and are in no way slower than they should be.
This is not the place to report problems with your site. Please make a new topic instead.

[vnemesis]

my websites: rf-tranquility and vnemesis.com are down/slow for me and my users ... can't even ping them ... thnx

[Victor01469]

Your websites are up, and have been up, and are in no way slower than they should be.

I have no way on finding out, but most likely, the reasoning behind this is that your IP was banned by the firewall for excessive simultaneous connections to the server.

If this is not the case, an admin will reply.

[funpkingv2]

your ip is banned from the firewall for making excessive connections (more then 10 simultaneous) to the server.

we have to do this to block the ddos attacks
you probably have one of those browser modifications which hammers webservers with connections to download faster

Making excessive connections??

How

And i have no mods on my webbrowser

I really like this host and i dont really want to switch.. And i dont know what is causing this..

[Victor01469]

What browser are you using?

And have you attempted at any point to refresh a page too fast, and too many times? That can cause the same thing to happen, depending on browser.

[funpkingv2]

Im using Firefox

Iv tried IE as well though..

And when it went down i was trying to see if it would come back up..


So refreshing a page to much makes me get IP banned?

[arudis]

Why is my site always down this is getting tiring can you please fix this? I know you guys are trying your best yea yea :mad:. But the problem is not fixed my site is down for at least 2 hours a day and not at the same time. You guys said 99.9% uptime I know im not good with math or anything but that is not 99.9% uptime
I'm always getting emails asking why my site is down and its annoying and making me and my site look bad I've been with this host for a while now and its always been good until now this has been happening for a week and a half
looks its down now. it doesn't always happen at this time it varies
but it only happens to my blog henryj.org not to my web design company arudis.com

[Victor01469]

arudis,

I can witness your site being down. An admin will look into this for you. Promptly.

Eric, may I PM you?

[Victor01469]

Not necessarily, that would only happen if you hit the refresh button too many times in a few seconds.

***PART OF POST REMOVED***.

[UnlimitedMB]

I just cleared all IP bans and the attack started back immediately.
DO NOT USE CGI PROXYS THEY ARE NOT SECURE

[arudis]

wait I think its only for php type things because henryj is wordpress and arudis isn't and it works but forum.arudis.com my forum is full php and it doesn't work this had something to do with php I know it

[UnlimitedMB]

No sites were down, some IP's are banned on the firewall for excessive connections.
The DDoS attack is still continuing and we must ban IPs to prevent the entire sever being down.
I modified the ban script a bit to be less aggressive.

[arudis]

ok thanks Ill tell you guys if my sites goes down anymore

[funpkingv2]

Well my site is up and running VERY fast

Thanks.

[mrquarter]

The attack was most likely caused by a SynFlooder.

A SynFlooder can use many IP's and attack a site. It is really hard to block these attackers.

Glad you got it working.