Forum down

[Tirant]

In US Central Daylight Time, I was unable to connect an hour ago, but as of 5 PM it is working again.
Another totally different site had a similar problem last week, with an absurd number of accesses by unregistered users, but they took measures and it works now.

[Observer]

it's been unsteady over here - sometimes it works, sometimes it doesn't. 

[Caras pet]

For me, the forum was unreachable from 2026-09-14, ca 07:30 until 2026-09-15, ca 17:30 (GMT +1, I tried to connect really often)
The forum an parts of the plaza where unreachable.
Since then, the forum is "blinking" (goes, goes not, goes, ...)

[teanndaorsa]

I don't think my changes actually fended it off, I think it is a bot-net that is being turned on and off, because traffic drops back to normal levels for hours at a time. You can see that obviously from the traffic graphs, it's not a natural day/night cycle, on Monday it was a hard drop back to normal all of a sudden. And then a few hours later (maybe after a short night's sleep for a hard-at-work hacker), it turns back on again and we're flooded.

If it were a targeted attack because someone doesn't like the site, it would probably target all the other Plaza sites as well. No-one has contacted the site trying to extort money from us to make it stop. I really can't guess with any confidence the motivations, but honestly, it sort of feels like someone is testing a botnet that attacks sites using the SMF forum software, maybe looking for a vulnerability, maybe just trying to see how effective it is before they use it to extort money out of a bigger site.

What is happening is that tens of thousands of random looking computers are requesting the root page of the forums, from all around the world. Normally, the visitors to the forums are like 99% from the US and 1% from a few other mostly English-speaking countries, and there are normally only about 1,500 requests and hour. While we're under attack I see 100 to 200 times as many requests in an hour, from all over, Brazil, Russia, Venezuela, Iran. Even the US traffic is 10x its normal level. Other than the fact that they visit the home page of the forums, there's nothing to distinguish them from real users. They don't even request a huge number of pages each, just a few, but there are so damned many of them that the cumulative effect is crippling. So all of the usual tools available for stemming the tide are ineffective.

I'm afraid that all we can really do is wait it out, and hope the instigator moves on to some other target.