SIXTEENmm

1833 films and counting...

High Load DDoS Attack - Blog

2020-02-01

This might just be another botnet looking to gather more followers into the herd, or it might be a directed attack against SIXTEENmm.

Currently:

There's about 10,000 requests/second hitting HTTP endpoints
Most attacks are trying to hit the search page with a payload.
- Somebody seems to believe there's an RCE in our search engine. We cannot currently confirm that, even using the series of attacks that are hitting.
- There is no reason to believe there is an RCE. This attack seems to be searching for one.
Attacks are coming from three different VPS groups.

Timeline of events:

7:15PM - Attack begins
7:18PM - Server alarm goes off and investigation begins
7:38PM - Attack reaches 10,000 requests/second
8:24PM - Server restarted
- Search locked to users only
- Search memory usage reduced
8:38PM - VPS providers notified
9:11PM - Attack seems to have stopped

Continue reading...