Not sure where else to post this..

[Please Register and Login to this forum to stop seeing this advertsing.]

[Zudane]

Just wanted to ask... some script kiddie is trying to be cool and keeps attacking my site with bots.. doing nothing more than really having a bunch of crawlers go to the site and after a minute or two, making the board go offline (see error below) for 10-20 seconds due to too many connections.

Now, it isn't much of an inconvenience as the forums aren't down long at all... but is there anything that can be done about it?
_________________


Harsh Reality - Unleash your creativity!

[admin (no pm's please)]

I have just blocked this at one level trying to leave your site running.

If need be I'm afraid I will have to take it offline.
_________________

Family Friendly Shareware | | Web Design/Services | Free Forums

[Zudane]

It seems to have worked.. I've seen it attempted twice after (maybe more) and only 5 registered bots and 5 "guest" bots have shown up.

I am guessing in an hour or two, when it still doesn't work he'll give up and leave.  Thank you ^_^
_________________


Harsh Reality - Unleash your creativity!

[admin (no pm's please)]

Seems like it has followed that pattern, there were some more attempts but easily dealt with.

I'd like to thank you for being responsible enough to report it.

I was already dealing with things as it happens, but knowledge always helps. For example in this case I did spend a few minutes on the wrong track as the attack vector was slightly similar to some portal stuff I know you have been doing. If I had read your report first I would have skipped from that a tad quicker.

When a site is attacked obviously one option is to temporarily suspend the site in question for the benefit of the overall service. But where possible this is avoided.
_________________

Family Friendly Shareware | | Web Design/Services | Free Forums

[Zudane]

So that would explain the reason one of my portals said "portal offline"  I thought that was you.

And I knew you'd be the one to deal with it, so best leave it to the best.  I <3 having an uber1337 admin ^_^
_________________


Harsh Reality - Unleash your creativity!

[Zudane]

I got some messages from the person on MSN, he said it was some DDoS attacks he did, with some of the useragents are listed as the bots, which is why the forum detects them like that... He had posted some of the code (googled it to find that it's a trojan you can find online), just wanted to know if that would help.

I have had: FAST WebCrawler [Crawler], WiseNut [Bot], Google [Bot], and Alta Vista [Bot] all active for the past few hours....

Here's the code he had pasted me...

CODE REMOVED

Remove that if you'd like later.

Edited By Symon

Code removed and put in office for Admin to see.
_________________


Harsh Reality - Unleash your creativity!

[admin (no pm's please)]

what is his msn id, this is criminal action!
_________________

Family Friendly Shareware | | Web Design/Services | Free Forums

[Zudane]

Removed msn addy

I have a chat log of it as well, if interested.
_________________


Harsh Reality - Unleash your creativity!

[admin (no pm's please)]

You should report the incident as we have done to:

abuse@msn.com

The action is criminal damage and some such cases have found the culprit up to their eyeballs in damages and even in jail. They can end up paying in spades as it is rare and expensive to get them to court so the legal costs are incredibly high.

Reporting what you know to msn is a small step in documenting their vandalism.

---

_________________

Family Friendly Shareware | | Web Design/Services | Free Forums