PlanetZ forums @ scopeusers.com

Less than 24 hours, cutting bandwidth by about 2/3rds

Total Bandwidth
Previous 24 hours
37.81 GB

Cached Bandwidth
Previous 24 hours
23.77 GB

Uncached Bandwidth
Previous 24 hours
14.04 GB

You can see the traffic pattern matches:

Also cut stale connections (where the full page was served) in half.

So what's the objective of China's bandwidth abuse? To disrupt and increase the cost of commerce in other countries?

No clue, it's cheap hosting so it really could be anyone exploiting the economic difference between cost of attack vs overseas maintenance against it. It could be unlicensed/unknown data collection for model building, or anything else too really. But given that I can see 3 sites in a related market and it's hitting only those--and only https access on those domains--on the servers I can see..well it does seem at least directed in that sense. InMusic sponsoring DDOS attacks? I doubt that, but who knows.

You can report issues of internet interference to the FCC at https://consumercomplaints.fcc.gov/hc/e ... m_id=38824

It's thousands of overseas web hosts, not a local ISP, but thanks!

Checking in again on this thread to report our progress. Total requests from *unique* visitors is still very high, and about half of the 1TB bandwidth that this traffic uses is now cached, which means that the traffic inbound is largely anonymized or from uniquely generated fingerprints and IP addresses, etc. This is after the bot-checks, too.

Over the last year, I have also watched numerous software vendors in the audio space move to the most secure setting (where it tells you that it's verifying you as human during the bot-checks). When I enabled that it showed no difference for the day it was enabled in usage patterns, so we're deferring that for now. But I may try that soon too.

On the flipside, the serving up of cached data has kept the forums more responsive for the rest of the userbase. And 50% reduction in load means that we deferred the need to upgrade for a while at a fraction of the cost (as mentioned before) so it's a good use of funds.

The steep drop in the curve at Christmas is interesting. Is this the same for all of the top five countries (or for some)? Just wondering if it's just one bad actor who is using bot nets in different countries, or whether we're seeing attacks by different parties.

By the way, I noticed that the forum can now be reached via IPv6 as well (because of Cloudfare), which is nice!

Interesting, good to know. Server should be serving IPv6 for many years, but maybe something between you and it. Or the Cloudflare DNS resolv helped....

Christmas was on a Friday I believe, which is a Saturday overseas. However the traffic patterns are similar going back to August.

Note again that the use of overseas datacenters could still be anyone globally...cheap place to buy bandwidth.

Yeah, the fact that most traffic comes from China doesn't mean that the attacks are done by China. I guess it just tells us, that there are many hacked machines overthere...

If the traffic pattern is the same for all the countries, it would suggest that the same actor is using bot nets in all these countries. Is that the case or do the patterns differ per county? In the latter case there might be multiple attackers at work.

The traffic involves so many data-center locations over such a long period of time, I'm not sure it's just hacked machines.

If it was purely AI agents crawling for model building, it wouldn't differentiate like that. And if it was just hacked boxes doing random things, the same argument applies. Yet my sample size is too small to be definitive. Of 5 forums I manage, only 2 get this level of traffic and both are audio related, another is gaming and the last 2 were old general tech forums that are not seeing much use anymore.

Whatever the cause, it makes doing something like this for any reason other than personal a net loss. So I want to help use this platform and community to push Scope 8 out into the world so we get a few more years out of this platform, and see what changes. But more on that where appropriate, I'm a bottleneck for arranging all the info right now.

There may be a DNS issue for a week or two, something new has occurred. Will report back when I have a solution.

Thanks for letting us know! DNS not working here at the moment (I've put the IP address in my hosts file for now, so that I can reach the forum).

The renewal date is here but there's a domain registration conflict from an unknown overseas registrar (ostensibly in China) keeping the renewal from processing here. I was given 2-4 weeks as a timeline for a response (not resolution), so let's hope this doesn't turn into a delay that allows them to get the domain after the 30 day renewal 'grace' period passes. Lots of fraud these days...

Also, we had 3.4 million connections (successful, not failed) from hosts in China this past month, using 0.8TB just for the DNS request and https connect. Meaning, not file downloads or etc. Cloudflare only mitigated about 40% of them via caching. That's not blocked bot counts either. Insane.

Fingers crossed!

arrrgghhh....

Thanks for posting the IP address on facebook! The cloudfare address I put in my hosts file doesn't work anymore.

Enjoying the silence here...

I was here since yesterday.

I think this will be resolved towards the middle of next week, sometime. The question is, did the weeks of downtime stop the bots from caring about attacking?

Yes, hopefully they have removed us from their list. Will be interesting to see.

Could you also post the IPv6 address of the forum here, please?