Website's Poor Performance (DDoS Attack)

[Roy 10,832 / 0]

Hello everybody, at around 5:00 PM EST, our website started experiencing poor performance and downtime. This was due to a DDoS attack that has overloaded our Apache server (the web server we currently use). This attack is coming from hundreds of sources (IPs) and most IPs have different providers from what I've seen. Therefore, we can't block the attack easily.

 

For the last six hours, I've been messing with Apache's configuration and installing modules for Apache and our firewall to see if it would help lessen the damage from the attack. Unfortunately, nothing has stopped the attack from overloading the CPU on the machine. However, even though the website loads slow, it is still responsive.

 

In the near future we will be moving to a machine using the NGINX web server. This web server will have better performance and should be able to process more requests per second meaning attacks such as these may not be as damaging (read more about Apache vs NGINX here, if you're interested). More info on the move will be made shortly.

 

Unfortunately the attack is still going on as of now (11:00 PM EST). If it continues throughout tomorrow, I will look into more configuration and so on to see if there's any more I can do to weaken the attack. Other than configuration and modules, there's nothing we can do to lessen the attack besides buying more resources.

 

More updates will be posted about this incident in the near future.

 

We apologize for this inconvenience and thank you for understanding.

[Roy 10,832 / 0]

I would also like to thank @Nick, @Xy_, and @setup.sh for giving me info and helping me.

 

Thanks!

[JerryBomb 452 / 9,328]

Everything wasn't fine there for a second. Jeez, did anyone else catch this?

[im not inactive you are 888 / 16,340]

No, I didn't get that, I got a message that said something along the lines of "DDoS in progress, Attackers might steal your information; click this button to go back to safety" or something like that, I overlooked it and thought it was just my iPhone's personal hotspot fucking me up at around 9pm.

[rapperdan 2,323 / 0]

tfw all I need is a small connection to this website and it's back up again, but ya I have it set to auto retry loading the website ecks dee attacks ecks dee 

what are thoooooose

 

also I left at around 11 pm something last night looks like you guys had a lot of issues...

 

look at time stamps,

 

I said I would get this website back up ecks dee

 

Sunday, January 7, 2018
12:56 PM - 昇天したパンケーキ: Hey so what exactly is going on with the gfl site is it getting ddosed?
3:02 PM - Dan Rappold | AMD: uhhh
3:02 PM - Dan Rappold | AMD: looks like this https://docs.google.com/document/d/1aaVXv4328-6tA8YOzC3VgiIDO4UN9FxeC1U3hcGiwjs/edit
3:02 PM - 昇天したパンケーキ: link removed?
3:02 PM - Dan Rappold | AMD: https://discord.gg/vDRzVJ
3:03 PM - 昇天したパンケーキ: is that for gfl
3:03 PM - Dan Rappold | AMD: it's a google doc link
3:03 PM - 昇天したパンケーキ: I already saw that I just wanted a more normal answer that doesn't require me reading a paragraph
3:06 PM - Dan Rappold | AMD: uhh
3:06 PM - Dan Rappold | AMD: some idiot
3:06 PM - Dan Rappold | AMD: ddos attack
3:06 PM - 昇天したパンケーキ: alright cool beans
3:06 PM - Dan Rappold | AMD: ya
3:06 PM - 昇天したパンケーキ: is it still happening or was it only last night
3:08 PM - Dan Rappold | AMD: still happening it seems
3:08 PM - 昇天したパンケーキ: Jesus
3:08 PM - 昇天したパンケーキ: I wonder what they gain from ddosing
3:08 PM - Dan Rappold | AMD: the site may work in some small strides shortly
3:09 PM - Dan Rappold | AMD: I just need to connect my shitty wok client and keep it connected
3:23 PM - 昇天したパンケーキ is now Online.
3:25 PM - 昇天したパンケーキ: So in what way would you guys go about of fixing it
3:32 PM - 昇天したパンケーキ is now playing Team Fortress 2. Click here to join.
Sunday, January 7, 2018

 

also it's working better then I expected the attack atm seems like it's almost completely nulled ecks dee

I thought this website would be off and on kinda deal working only for a few seconds and going back off...

 

the lag is very minimal and I was expecting a lot worse tbh...
 

Edited January 7, 2018 by rapperdan

[Roy 10,832 / 0]

I made a Google Doc with more information about this incident here.

 

Thanks.

[rapperdan 2,323 / 0]

2 hours ago, Roy said:

I made a Google Doc with more information about this incident here.

 

Thanks.

you used a snapshot? boi I'm gonna need the story behind that because that is like using some VM stuff and well all ik about snapshots and the such is it's like a time based thing so did you use like a passed data capture or something? the use of snapshots as far as I know are from this website https://web.archive.org/ and well I'm kinda wondering how you went about that.