Rantburg.com was hammered by a multitude of servers, which slowed the server down to a crawl, last Monday and Tuesday.
I call it a distributed denial of service attack, in that there were a number of servers listed in the scan hitting the ethernet port hard with data totaling at one point - cumulatively - 50 gigabytes in about 20 minutes. May not seem like much, but when its in 4,000 byte packets hitting the port at one per second, it's a problem.
As may or may not have indicated before, the great bulk of the servers hammering rantburg.com were in Latin America, which led me to believe it was the inevitable reaction of bad actors to Trump's "Gunboat Diplomacy."
Dunno.
Deliberately analyzing the IPs hitting the server, about two thirds of them were not coming from a live host, i.e. they were spoofed IPs.
The attacks were finally mitigated when one of the command servers directing the attacks was blocked, along with about 1,500 other servers. All blocked netblocks contained Unix/Linux web servers: A shot in the dark, as it were.
A little bit older and a little wiser, we have a much better idea of what to look for going forward and how to defend against such attacks.
The Bad Guys will return, there can be no doubt.
|
