Report DDoS attack____________________As everyone has certainly noticed, this past week, TalkImg was flooded with millions of hits per minute, suggesting that it was under a large-scale DDoS attack. From the beginning I made it clear that I do not collect any data, so there is no data to steal. Also, the only service provided is to host images to be viewed on the Bitcointalk forum. Therefore, until now, I have not been able to understand the reason for this attack. I'm most likely suffering some side effects from other attacks, I don't know.
I'm not an expert in these cases, and in almost 20 years of developing websites, I've never had this type of problem. Normally I fought to receive visitors, not to drive them away. So this was something completely new for me, which helped me learn more things in this crazy world of the internet. In this sense, this report is based on the experience of someone who has never experienced this situation, and who is not highly specialized in these cases.
THE BEGINNINGAround 17h00 (all times in GMT), 04/nov, the first signs began to appear that something was wrong.
About an hour later the site is shut down by the host, without any direct communication to me.
At 19h00 I contact the host to check the situation, and that's when I was informed of the thousands - not to say millions - of hits I was receiving on the server. So I recommend enabling Cloudflare to try to mitigate the attack. And that's how I started taking action against the DDoS attack.
THE COMBATInitially it seems that adding the recommended security layers via Cloudflare is starting to take effect. At around 7h00 am on 05/nov, the number of accesses had already decreased and apparently the conditions to reactivate the server were met.
But, it seems that soon after someone
communicated this information here on the forum, the attack resumes. Coincidentally or not, it seems like everything is back to square one. So, throughout that day, I tried to create blocks via Cloudflare, to try to mitigate the attack, and around 18h00 the site was
back online. Now it was time to start checking the settings so that everything returns to normal for everyone.
Until at the end of the morning of 06/nov everything returns to the same, a significant load of accesses and for security the server blocking returns. Back to my fight, to try to mitigate the attack, increasing the blocks even further via Cloudflare, ending up purchasing a Pro account, to have more tools at my disposal. He was trying everything to mitigate the attack.
In this sense, throughout the day of 7/nov I monitored the site's traffic almost hour by hour, creating a block on all types of IPs that were underloading the server. This way, I was able to mitigate the attack and stabilize the attack, I was able to put practically everything online. With some limitations, but the most important thing was restored, the images appeared on the forum.
IS IT ENDED?I can say that at least it's under control. For the last 2 days I have been monitoring all requests handled by Cloudflare almost hourly. I've already managed to reset practically all of the site's functionality, and reduce the alert level on Cloudflare a little.
Yet almost every hour there is an overload of requests, with thousands of them mitigated by Cloudflare. Therefore, from time to time the service becomes a little slower, especially for those trying to upload images.
Here's a graph of what this crazy week was like, based on data from Cloudflare:
As we can see, at this point there are still a lot of requests occurring and being mitigated by Cloudflare. I wonder when this will end. But I won't give up.
JUST COINCIDENCE?As I already mentioned, the TalkImg service does not have any type of sensitive information that would be of special interest to hackers. Even so, the attack is happening or has happened, without any type of benefit. Or did you have it? Well, I'm not one to feed conspiracy theories, but note some points that I found interesting throughout this week.
Days before this event began, I asked my host for some information about a possible improvement in server conditions. I was starting to plan in 3 or 4 months to do a service upgrade. They even made some preparatory adjustments, so I could move forward - immediately, with the upgrade. But, I didn't do it right away, and after about 4 days, the attack began.
On 07/nov (see the sequence of events mentioned above), after several conversations with the host team, I asked if upgrading the server could help resolve the situation. In which the answer is positive, saying that making this change could help control the situation. And everything starts to calm down.
In the meantime, a few more things came up, which I found strange, but I resolved promptly (later I can talk about it).
Well, despite finding all this coincidental, the host I'm using is well-referenced and one of the best in the world. So, I believe it was just that, coincidence.
One thing is for sure, I used Cloudflare for the first time and I wondered: how do they make money doing the same thing they do on paid plans? Well, I purchased a Pro plan for TalkImg.
Result: Cloudflare 1 vs 0 TalkImg.
I was planning to upgrade the server in 3 or 4 months, and now I'm thinking about doing it in the next few days. I haven't done it yet, but I will soon.
Result: Host 1 vs 0 TalkImg
But, I may have lost in these two rounds, but the next one I will be winning. Because I learned more about using Cloudflare, I improved my server-side data analysis skills and anomaly detection skills. Furthermore, I feel that the TalkImg community has become stronger.
Result: TalkImg 4 vs 2 Internet Barons
I would like to finish by thanking you for your support during all these events. Rest assured, I will continue to do everything I can to keep the service online.
PS: Let's see if the attack doesn't come back with full force after this post.
