25 October 2017

Under Attack by Robots

Political Calculations appears to be under a low grade, but escalating Distributed Denial of Service (DDOS) attack. The following chart illustrates what we're seeing in our site traffic for in the period from 19 October 2017 through 24 October 2017.

Political Calculations Site Traffic, Daily Summary, 19 October 2017 through 24 October 2017

The attack appears to originate from a number of ISP servers associated with Online Sas based at Southend in the United Kingdom. The attack began on 19 October 2017. The following screen shot shows the first incursion by the botnet that we detected:

Political Calculations Site Traffic Excerpt, 19 October 2017 23:22:17 AM PDT

Since then, the number of site visits from Online SAS servers has escalated. The next screen shot of our site traffic shows a the most recent three minute period (at the time we snapped the picture) on 25 October 2017.

Political Calculations Site Traffic Excerpt, 25 October 2017 04:40:28 AM PDT to 04

Other than the frequency, the main thing to take away from this screen shot is the number of different servers that are involved. Beyond that, Online SAS/Poneytelecom.eu's servers have been associated with a number of server-based attacks in the last year.

As attacks go, the botnet behind the DDoS at work here is pretty low grade. We don't think it will succeed in disabling our site, but the escalating frequency of the attacks is a concern. We can confirm however that being probed by a mysterious botnet is much less creepy than some of the stalking-like behavior we've observed in our site traffic statistics in the past.

Update 26 October 2017: Shining a light on the activity appears to have produced a positive result - the automated attack has ended. While we described it above as a "low grade" attack, we think it was perhaps more of a sniffing or probing event. We'll be curious to find if other sites encounter a similar experience.