Site problems yesterday evening

[The Kaptain]

Any white page or 500 error messages you were getting was due to our server being critically overloaded. At one point the CPU usage hit almost 600%!

cpu.jpg

I contacted Kualo who investigated deeper and found the following

Upon reviewing the access logs, we noticed a high volume of requests from Alibaba Cloud IP addresses across all your sites. These requests appeared random, such as the following, which was contributing to the recent spike in CPU usage

Effectively we were under a mild DOS attack

To protect your sites and improve performance, we promptly blocked Alibaba Cloud's IP ranges using cPanel's IP Blocker. After monitoring the situation for a few minutes, I'm pleased to share that CPU usage has now dropped to 10% over the past 30 minutes, and your sites are loading significantly faster.

Its a never ending war with these, but at least we are back to 'normal' now

[Dan Steel]

[Coyote Jim]

Fix.PNG

Fix Found.

[Mark57]

Amazing that anyone would want to attack this site. Was it because some of us were a bit disrespectful about whether ‘high end’ cables make a (good) difference or not?

[Coyote Jim]

I must have posted something interesting.

[The Kaptain]

Amazing that anyone would want to attack this site. Was it because some of us were a bit disrespectful about whether ‘high end’ cables make a (good) difference or not?

Every site gets it at least once, but we are lucky and we have been hit a second time

I am so very glad we are with Kualo now as they are more than happy to sort it out. When it happened previously in 2014 we were with a different host and I had to fix it myself.

I went through the error log back then and

From the beginning of the month up until mid day today there are 209499 lines in the log. The first instance of this crawler was at line 106496 and lasted for the next 101750 lines. Thats 101750 hits in about 14 hours. A continuous 10 hits a second for 14 hours. All from the same ip.

so that was an easy fix, but this time they were origination from different ip's making the job a lot harder.

I must have posted something interesting.

I think I missed that

[Coyote Jim]

Amazing that anyone would want to attack this site. Was it because some of us were a bit disrespectful about whether ‘high end’ cables make a (good) difference or not?

Every site gets it at least once, but we are lucky and we have been hit a second time

I am so very glad we are with Kualo now as they are more than happy to sort it out. When it happened previously in 2014 we were with a different host and I had to fix it myself.

I went through the error log back then and

From the beginning of the month up until mid day today there are 209499 lines in the log. The first instance of this crawler was at line 106496 and lasted for the next 101750 lines. Thats 101750 hits in about 14 hours. A continuous 10 hits a second for 14 hours. All from the same ip.

so that was an easy fix, but this time they were origination from different ip's making the job a lot harder.

I must have posted something interesting.

I think I missed that