• Hey Guest!
    British Car Forum has been supporting enthusiasts for over 25 years by providing a great place to share our love for British cars. You can support our efforts by upgrading your membership for less than the dues of most car clubs. There are some perks with a member upgrade!
    **Upgrade Now**
    (PS: Upgraded members don't see this banner, nor will you see the Google ads that appear on the site.)

DDOS Attack

Share this page

Basil

Basil

Administrator
Staff member
Boss
Online
Woke up this morning to find the server intermittently not responsive. (Some of you may have discovered this problem also). After extensive research, I discovered the site was being hit by a large number of IP addresses, all originating from the same block of addresses in Singapore.

I have blocked these in teh firewall so hopefully things will return to normal.
 
Thanks for the update. Is the DDOS issue unrelated to the slow down issue we had recently?

TM
 
NutmegCT said:
Thanks for the update. Is the DDOS issue unrelated to the slow down issue we had recently?

TM
Click to expand...
Hard to say. I know that earlier the data center was having issues due to a cut fiber and had to re-route some traffic. It was surmised at the time that was the cause of the issue, but at that time I did not look into further causes as it seemed to resolve.
 
YakkoWarner said:
Interesting that they were able to hit the site directly - I thought the whole point of thatCloudflare intermediate layer (which sometimes seems to be more trouble than solution) was to prevent that sort of thing from happening.....
Click to expand...
I do use Cloudflare on the site, but only Cloudflare Turnstile for new-user registrations. That helps prevent bots from creating accounts, but it doesn't put the entire website behind Cloudflare.

Normal visitors — including bots — still connect directly to my web server. So a large number of bots can hit the site and overwhelm the server even though Cloudflare is being used for registration protection. To have Cloudflare filter that traffic, I would need to route the site's regular web traffic through Cloudflare's proxy, not just use Turnstile on the registration page.

Certainly I could put the entire BCF behind Cloudflare, which would provide additional protection against bots, DDoS attacks, etc., but that also adds another layer between my members and my server. It means Cloudflare would be proxying all of the forum's web traffic, with additional DNS, caching, firewall, SSL, and security settings that have to be configured and maintained correctly.

I preferred to keep the setup simpler and have members connect directly to the server, while using Cloudflare Turnstile where it's especially useful — stopping automated registrations. The downside is that the server is more exposed to things like the bot flood we experienced today, so it's a tradeoff between simplicity and additional protection.
 
Ok, so what’s the end game of all the bots overloading the site?
Is it a ransom thing?
 
This is what I found from a search…..

The main purpose of a Distributed Denial of Service (DDoS) attack is to overwhelm a website, server, or network with massive amounts of fake traffic so that real users cannot access it. [1, 2]

Core Goals and Impacts
    • Disruption: Take a service offline or make it run very slowly.
    • Exhaustion: Use up all of the target's bandwidth, memory, or processing power.
    • Downtime: Cost the target business money, time, and customer trust.

Common Motivations
Attackers launch these campaigns for several reasons:
    • Financial Extortion: Demanding a ransom payment to stop the attack.
    • Hacktivism: Making a political statement or protesting an organization.
    • Competitive Sabotage: Harming a rival business or knocking out their sales platform.
    • Distraction: Hiding a simultaneous data breach or other cybercrime.
    • Vandals and Revenge: Causing chaos or getting back at an individual or company.
 
In case its related, I keep getting banners (on BCF) for Starlink, Onlislux, "Click here to continue" (No further info), "PDFFlows", "Click
download to use extension free", and "/+ ace "
Bob.
 
Bob - are those just random ads, which appear to many BCF users?

Tom M.
 
bobhustead said:
I have never had them on BCF before today.
Bob
Click to expand...
Did you have a subscription before? If you had a subscription you wouldn’t see them, but if you had a subscription that expired then you will see those Google ads. If you have an active subscription you won’t see them.
 
Bas
I upgraded my subscription several years ago whilst the underlying lower level subscription was midstream. Pretty sure upgraded while in Fl (winter months), while I originally joined when in NC (summer). I don't know when my memberships now begin and end.
Bob
 
bobhustead said:
Bas
I upgraded my subscription several years ago whilst the underlying lower level subscription was midstream. Pretty sure upgraded while in Fl (winter months), while I originally joined when in NC (summer). I don't know when my memberships now begin and end.
Bob
Click to expand...
I’ll check when I get home later and PM you.
 
Back
Top