Small scale DOS attack?

[draggar]

I run a fan site for a game show on a local radio morning show. I would expect at leadt 95% of the traffic to come from the local area / US based ISPs. The game show is played at about 8:15AM Mon-Fri (this is important later).

I would also expect spam attempts coming in from some areas - I've already seen them come in from China, Ukraine, and the Middle East.

But this is what gets me. Ever since they mentioned the site on the radio a few years ago a fan site for the show has acted negatively towards my site (and me). The site is owned by someone in Denmark.

I've noticed spikes in the traffic lately to the point where it is almost impossible to access the site from 6:30AM to about 10AM (almost the entire length of the show). Updating is impossible during this time.

I've been keeping an eye on IP logs and I"ve noticed that I'm getting thousads of hits per hour on the main index of the forums (now closed and the folder is renamed). Yes, the usual suspects - but over 75% of the traffic is from RIPE based out of Amsterdam. I've blocked several xxx.xxx. ranges from them but some seem to still get in. Is RIPE a normal source of spam attempts or may something more sinister be at play?

 

[Deleted member 5660]

RIPE is one of registries that allocates IP addresses. You can go to http://network-tools.com and use the network lookup to see who owns the IP from the RIPE database. It is like ARIN which is for North America.

If you want to lock out foreign IP's use one of those programs that detects the country of origin of the IP. I use Country Hawk but there are several. You can use Browser Hawk to detect all kinds of stuff as well. See http://analyze.privacy.net

 

[DN BROKER]

good luck

 

[draggar]

It's been a few days since I banned several of the highest offending IPs and IP ranges (by last two octets) and I shut down the forum and renamed the folder it's in. Site is a lot faster now (I can edit it!).

I also just checked and the top 10 accessing IP addresses are all based out of the USA (including some very low IPs?). Hopefully the offender has learned his lesson.

 

[DN BROKER]

nice work