Under DDoS Attack

[Smokin Mils]

My forum at www.smokinelite.com is currently under a DDoS attack. I'm sure because it shows 1600+ users on line rather than the usual ~350.

Can anything be done about this?

Thank you

[SLGray]

Exactly Forumotion is doing a maintenance on the servers. I get a page with maintenance notice on it.

[Smokin Mils]

Do forums usually show a huge number of users on line for these? The start of it coincided perfectly with a botnet attack on an IRC channel we own, and with the huge number of users on line I thought it might be a DDoS attack.

[SLGray]

I really do not know why it would show that right before a maintenance, unless there were exactly 1,600 people looking at the forum.

[Smokin Mils]

There definitely are not 1600 users looking at the forum. Nearly all are guests and that's about 5x more users than usual. It went from about 350 to about 1641 in a minute and stayed there. This is almost certainly a DDoS attack.

[Smokin Mils]

Thanks for the comments anyway slg. I'm not sure there is anything that anyone can do about this so I'll just wait.

[SLGray]

Please don't double/triple post. Your post need to be separated by 24 hours before bumping, replying or adding more information. Please use the edit button instead!

You will have to wait until the maintenance is over.

[Smokin Mils]

It isn't maintenance, it's a DDoS attack. But okay thanks.

[SLGray]

No, it is a maintenance.

WWW.SMOKINELITE.COM

Maintenance in progress : Refresh Return to index
We are actually proceeding a maintenance and will be back in a few minutes.
You will find useful informations on our Support forum. Sorry for any inconvenience that may be caused by this maintenance. Thank you for your patience.

[Smokin Mils]

I'm really not sure about that. If you refresh a few times the forum will load. At the bottom it shows an impossible number of people on line. I think the maintenance page is simply the default page when the site doesn't load so it could also be the result of a DDoS attack, which would explain the impossible number of guests viewing the forum.

I've experienced maintenance and I've experience DDoS attacks, and I believe that this is a DDoS attack.

[Smokin Mils]

It's been an hour now. Maintenance doesn't usually take this long

[SLGray]

Please don't double/triple post. Your post need to be separated by 24 hours before bumping, replying or adding more information. Please use the edit button instead! This is your second reminder about double posting.

Sometimes maintenance can take a long time.

[Smokin Mils]

Now there is an "adfly" screen most times you visit my site, and all usergroups and permissions have been reset to defaults. This will take days to fix.

Is there some way that I can get rid of the adfly thing? I'd like to disable that. I can't find where to pay to remove it.

[Shadow]

Hello,

Your forum loads fine for me, without adf.ly page.

Please provide a screenshot of what you get

[Smokin Mils]

If you refresh a few times you will get it too.

[Shadow]

No, I don't get it.

Have you checked with your users if they have this problem too ?

[Smokin Mils]

Yes, the users have brought it up. Everyone sees it. It comes up about half the time you visit my forum.

Heres a thread about it, for example: http://www.smokinelite.com/t61954-what-is-going-on-with-the-forum

And I'm talking with many people about it in an IRC channel.

I'm starting to get a little worried because AdFly is listed as malware and a search for it brings up a load of guides on removing AdFly viruses.

[Shadow]

Are you the founder of the forum ?

[Smokin Mils]

Yes I am the founder.

[Shadow]

OK thanks for these informations.

I'll try to see what's happened

[Smokin Mils]

Okay, thank you Leloo. I appreciate the help.

I don't know if this will help but here's a recent thread with similar problems: https://help.forumotion.com/t107089-adfly-issues#699296

The forum might have detected the DDoS attack a few hours ago as suspicious activity. We were DDoSed for several hours with about 1200 guests (a botnet) visiting the forum.

Also, all forum name colours are not being displayed correctly. I've checked in admin panel and we do have all the "color group members" tick boxes checked for those groups, but the colour groups are not displaying at the bottom of the index and nobody has a coloured name.

[Shadow]

Why are you talking about a DDoS attack ?

It has nothing to do with this topic, that what I thought at first, but this kind of error only happen for founder which have their email, IP address and username blocked by the system antispam.
I checked, that's not your case.
And some other users have the problem.

But not me, that's why it's really difficult to help you.

Can you please check with your users which browser they use, and which is yours ?

[Smokin Mils]

I asked a few people 1) if they get the adfly page and 2) what browser they are using. Everyone said they get the adfly page and use a Firefox or Chrome.

I use Chrome.

If the AdFly page comes up with some kinds of suspicious activity then it might have flagged a load of peoples IPs as suspicious. A few hours ago everyone was IP banned for some time apparently.

[Shadow]

OK thanks !!
Do you have a screenshot of this maintenance page you had previously by any chance ?

[Smokin Mils]

Unfortunately not but it was the usual maintenance page. I've seen it before when we are under maintenance, I'm sure it's the same one.

Do you have any idea why we had ~1400 extra guests suddenly visiting the forums last night which all came in a minute and left just as suddenly after a few hours?

[Shadow]

No, I'll ask to our technicians if anything happened.

Have you cleared your cache and cookies because I really don't have this adf.ly problem on my side

[Smokin Mils]

I just cleared cache and cookies and still have the problem.

The Adfly ads might not be activated for France, if that's where you are.

[Mike]

I just cleared cache and cookies and still have the problem.

The Adfly ads might not be activated for France, if that's where you are.

The ads aren't on there for me either. I'm in USA.

[Smokin Mils]

I stopped getting the Adfly page so I think that might be gone now (I still need to check with users). Forum name colours are still not working.

EDIT: other users are reporting that the Adfly problem is gone now.

Could someone please look into the problem with forum name colours?

Thanks for the help so far.

[Mike]

gimme about 10 mins to look through your CSS. I'll tell you if its a CSS Error.