{"topic":{"id":12141,"title":"DDoS 记录帖","slug":"topic","userId":4668,"categoryId":2,"createdAt":"2024-05-15 15:54:03.906772","bumpedAt":"2024-10-09 11:42:29.883218","views":635,"postsCount":12,"highestPostNumber":15,"likeCount":13,"closed":false,"pinned":false,"pinnedGlobally":false,"pinnedAt":null,"pinnedUntil":null,"isBanner":false,"excerpt":"第三次 May 15, 2024 (Asia/Shanghai) 先是 caddy 挂了，我以为是程序跑飞了，其实不是，查日志看挂掉的原因是 OOM kill，就是被 D 了。 caddy 这个 go 程序挺优质的，基本不会跑飞。后面我用 Restart=always 运行 caddy，则请求全转发到了 ruby，吃完全部资源，说明了： discourse 容器里的反代 nginx 的 rate limit 毛用没有 😉 [grap…","deletedAt":null,"isAnonymous":false,"isPrivate":false,"isMembersOnly":false,"category":{"id":2,"name":"网站","slug":"website","color":"986a44"},"author":{"id":4668,"username":"IO","name":null,"avatarUrl":null},"realAuthor":{"id":4668,"username":"IO","name":null,"avatarUrl":null},"tags":["ddos"]},"posts":[{"id":32344,"postNumber":1,"raw":"## 第三次 [date=2024-05-15 timezone=\"Asia/Shanghai\"]\n\n## 先是 caddy 挂了，我以为是程序跑飞了，其实不是，查日志看挂掉的原因是 OOM kill，就是被 D 了。\n\ncaddy 这个 go 程序挺优质的，基本不会跑飞。\n\n后面我用 `Restart=always` 运行 caddy，则请求全转发到了 ruby，吃完全部资源，说明了：\ndiscourse 容器里的反代 nginx 的 rate limit 毛用没有 :wink:\n\n\n[graphviz]\ndigraph simple\n{\na -> b1 [label=\" ✔️\"];\nb1 -> c -> d;\na -> b2 [ label=\"❌\"];\nb2 -> c;\na [label=\"访客\"];\nb1 [label=\"under attack: 经过 CF 清洗后到达不监听公网端口的 cloudflared\"];\nb2 [label=\"normally: caddy 0.0.0.0:443\"];\nc [label=\"nginx in docker bundled with discourse with rate limit\"];\nd [label=\"Unicorn(Ruby App's HTTP server) running backend: Rails\"];\n}\n[/graphviz]\n\n\n[grid]\n![Screenshot_20240515_234541|690x258](/uploads/image/72/95/729502131a9026ffd3a72dcc53b298f699e10a9d9523721143f6a79622bd0a85.avif)\n![Screenshot_20240515_234535|690x240](/uploads/image/b3/69/b36998c1344b3626c635ac6d4e79677f86608f44c98dc7b50270b6fe0904fb37.avif)\n![Screenshot_20240515_234515|690x248](/uploads/image/af/26/af26e328bac61859183175d73206507280db5451b5ae2f4c844f73e949ee25ea.avif)\n![Screenshot_20240515_234449|690x294](/uploads/image/22/73/2273f56a8cbf23cb84e70e14369fce8033697d2706e937df78291c0f1dbcd4fe.avif)\n![Screenshot_20240515_234442|690x237](/uploads/image/bc/f9/bcf9effebbc1d2c9843f2e106d03ee27808e6124d4a2d9d6588dd59584fae488.avif)\n![Screenshot_20240515_234430|690x216](/uploads/image/08/25/0825e9dabdb28cf0062aa5699b5d388b0f87cadf26441fd2a5825f979d94defb.avif)\n![Screenshot_20240515_234426|690x216](/uploads/image/fb/24/fb248908153108fa93ef64071c176a1c5203711c087a2c46cab7cd46f13d3914.avif)\n![Screenshot_20240515_234417|690x245](/uploads/image/b1/43/b1435fe5f4ebd2c1f93455a76a1e576e741cddebfd6b368569a29bf8cbabadf7.avif)\n![Screenshot_20240515_234410|690x247](/uploads/image/b0/15/b015958e38e49b29bc6f0f52ced947c827e139924e0d15f77b827ae90b6fb824.avif)\n![Screenshot_20240515_234403|690x312](/uploads/image/f8/3c/f83cbc6aaaedd7d170a057964645d492c34dfc5ef94ae8743f416813ef1f0d18.avif)\n![Screenshot_20240515_234354|690x361](/uploads/image/c3/c2/c3c2dc31f6b4a400ee6a01bc49c7a70cc5677f4a69c5596228f7328905116f1d.avif)\n[/grid]\n\n## caddy 不抗 d\n\n虽然我中途调整了 xjtu.app 仅仅 respond \"交大門正在被网络攻击，攻击流量已结束\"，这时候攻击流量仅在 caddy，导致 caddy 占用 560% 的 CPU（6 核占满），你甚至连“交大門正在被网络攻击”几个字都看不到。 :a_grinning_face_with_sweat:\n\n\n\n攻击进行 de 断断续续，让我怀疑应该是有人在后面操作。\n\n我只好关掉了 caddy，换用 CF Argo Tunnel 拉之后，这回轮到 cloudflared 负载达到 260% 了（这让我有点恐慌 :dizzy_eyes:），我只好在控制台打开了`Under Attack Mode`，这回需要人机验证了：\n![Screenshot_20240516_000433|690x283](/uploads/image/74/8e/748e54c14ded7a18abd542fe51e21e680432394f40e273610e15c7aa2f54187c.avif)\n过了一小会负载正常了，也许是 CF 滤掉了流量，也许是攻击者休息一下打交去了 :snake:。\n\n## 让我们看看这一波攻击的流量有多猛： :a_grinning_face_with_sweat:\n\n![Screenshot_20240516_001153|690x275](/uploads/image/cc/82/cc8210de804d19ade1c4629b392452d61763cd0121b2424b147864658262d917.avif)\n\n## 看看 CF 的日志，是哪些 IP 在攻击呢？\n\n\n[grid mode=\"tile\"]\n![Screenshot_20240516_002124|690x411](/uploads/image/47/b1/47b1f61cd9284828840d5afebc95e613a9d75882b05b0da7710ad194b79684d1.avif)\n\n![Screenshot_20240516_001827|689x381](/uploads/image/1d/62/1d620c64e2162996b5d5d1f9f70f91858448a6eaa177f167979d57ff0e513fbc.avif)\n[/grid]\n\n对这些 IP 的攻击者，如果听得懂的话，我想说：谢谢你，因为有你让我第一次亲身应对 ddos，欢迎再来打，还是要多打，不要歇。\n\n## 最后，超级感谢 CloudFlare 公司的网络服务\n\n造福我这样的穷蛆。\n\n服务器厂商除了 OVH 抗打，建站老老实实用 CF，不要抱有侥幸心理。NetCup 性价比虽全球独树一帜，但不抗打。NetCup root server 是杜甫，你要一直打，CPU 占满也不会被停机。所以最好能写个脚本监控状态，自动启停服务/更换线路/切换被 attack 级别。\n\n\n之前 CloudFlare 公司有小可爱给我发邮件，问我个有空单独联系他们。我虽然没钱换付费套餐，但觉得非常荣幸。\n\n---\n您好，\n \n我是 Cloudflare 的客户顾问 ``，主要负责您的账户事宜。\n \n我有留意到您的账号在 Cloudflare 上已经使用了一段时间，不知道您目前为止的使用体验如何？非常希望有机会跟您聊一下，为您提供一些有帮助的优化信息，可以在账户和相关配置方面以及业务调整方面能帮到您，让您有一个最佳的体验。\n \n您可以添加我签名中的任何联系方式：\n``\n \n如果您方便的话，我真诚希望就账户和相关配置和您做个简单的沟通。如您平日业务繁忙，是否能麻烦您帮忙引荐一下其他负责技术方面的同事跟我对接。\n \n期待您的回复，谢谢！\n顺祝商祺！\n\n--- \n\n可能以为我是 XJTU 的雇员，然而我是 one-man :)\n\n美国公司就是会做生意，这种营销邮件不像某些公司那样谈钱，让你买买买、升级，CF 只是说：\n> 我真诚希望就账户和相关配置和您做个简单的沟通。\n\n让人觉得非常温馨，我要有钱了肯定会花钱的。\n\n---\n\n## 第一次 [date=2024-05-11 timezone=\"Asia/Shanghai\"]\n Fri May 10 2024, 18:58:05 CEST \n空心菜 [1:04 am](https://xjtu.app/chat/c/-/2/42984)\n\n刚才有点诡异\n\n服务器，容器都没有重启，遇到 502 错误，突然高负载甚至 discourse 出现 extreme load 的横幅\n\n## 第二次 [date=2024-05-13 timezone=\"Asia/Shanghai\"]\nMon May 13 2024, 03:47:59 CEST \n空心菜 [10:14 pm](https://xjtu.app/chat/c/-/2/43087)\n\n我怀疑我们网站刚才是被 DDoS/CC 攻击了\n\n空心菜 [10:16 pm](https://xjtu.app/chat/c/-/2/43091)\n\n刚才服务器压力巨大，我把唯一暴露在公网的 web 服务器 caddy 给停掉就好了\n\n空心菜 [10:18 pm](https://xjtu.app/chat/c/-/2/43093)\n\n在我发现这个问题之后，停掉了 caddy，这段时间浏览器应该显示无法连接。我在这段时间配置了使用 cloudflare argo tunnel，通过 CF 网络访问本站，保证公网 443 端口没有东西\n\n我昨天还怀疑可能是 Discourse 程序跑飞了，刚才我测试了重启 caddy 之后立马 cpu 占满，vnstat/iftop 看到异常的流量\n\n好在我的服务器是 6C16G 独服，要是早先的 2C2G 恐怕 SSH 都用不了\n\n空心菜 [10:23 pm](https://xjtu.app/chat/c/-/2/43097)\n\n从今天开始我将完全依赖 CloudFlare 的保护，至于网速应该没有多大影响，因为原来的服务器在德国，本来就不指望有大陆优化","cooked":"

第三次 May 15, 2024 (Asia/Shanghai)

先是 caddy 挂了，我以为是程序跑飞了，其实不是，查日志看挂掉的原因是 OOM kill，就是被 D 了。

caddy 这个 go 程序挺优质的，基本不会跑飞。

后面我用 Restart=always 运行 caddy，则请求全转发到了 ruby，吃完全部资源，说明了：
\ndiscourse 容器里的反代 nginx 的 rate limit 毛用没有 😉

[graphviz]
\ndigraph simple
\n{
\na -> b1 [label=\" ✔️\"];
\nb1 -> c -> d;
\na -> b2 [ label=\"❌\"];
\nb2 -> c;
\na [label=\"访客\"];
\nb1 [label=\"under attack: 经过 CF 清洗后到达不监听公网端口的 cloudflared\"];
\nb2 [label=\"normally: caddy 0.0.0.0:443\"];
\nc [label=\"nginx in docker bundled with discourse with rate limit\"];
\nd [label=\"Unicorn(Ruby App's HTTP server) running backend: Rails\"];
\n}
\n[/graphviz]

$\"Screenshot_20240515_234541\"$
\n $\"Screenshot_20240515_234535\"$
\n $\"Screenshot_20240515_234515\"$
\n $\"Screenshot_20240515_234449\"$
\n $\"Screenshot_20240515_234442\"$
\n $\"Screenshot_20240515_234430\"$
\n $\"Screenshot_20240515_234426\"$
\n $\"Screenshot_20240515_234417\"$
\n $\"Screenshot_20240515_234410\"$
\n $\"Screenshot_20240515_234403\"$
\n $\"Screenshot_20240515_234354\"$

caddy 不抗 d

虽然我中途调整了 xjtu.app 仅仅 respond \"交大門正在被网络攻击，攻击流量已结束\"，这时候攻击流量仅在 caddy，导致 caddy 占用 560% 的 CPU（6 核占满），你甚至连“交大門正在被网络攻击”几个字都看不到。 $\":a_grinning_face_with_sweat:\"$

攻击进行 de 断断续续，让我怀疑应该是有人在后面操作。

我只好关掉了 caddy，换用 CF Argo Tunnel 拉之后，这回轮到 cloudflared 负载达到 260% 了（这让我有点恐慌 😵‍💫），我只好在控制台打开了Under Attack Mode，这回需要人机验证了：
\n $\"Screenshot_20240516_000433\"$
\n过了一小会负载正常了，也许是 CF 滤掉了流量，也许是攻击者休息一下打交去了 🐍。

让我们看看这一波攻击的流量有多猛： $\":a_grinning_face_with_sweat:\"$

$\"Screenshot_20240516_001153\"$

看看 CF 的日志，是哪些 IP 在攻击呢？

$\"Screenshot_20240516_002124\"$

$\"Screenshot_20240516_001827\"$

对这些 IP 的攻击者，如果听得懂的话，我想说：谢谢你，因为有你让我第一次亲身应对 ddos，欢迎再来打，还是要多打，不要歇。

最后，超级感谢 CloudFlare 公司的网络服务

造福我这样的穷蛆。

服务器厂商除了 OVH 抗打，建站老老实实用 CF，不要抱有侥幸心理。NetCup 性价比虽全球独树一帜，但不抗打。NetCup root server 是杜甫，你要一直打，CPU 占满也不会被停机。所以最好能写个脚本监控状态，自动启停服务/更换线路/切换被 attack 级别。

之前 CloudFlare 公司有小可爱给我发邮件，问我个有空单独联系他们。我虽然没钱换付费套餐，但觉得非常荣幸。

您好，

我是 Cloudflare 的客户顾问 <redacted>，主要负责您的账户事宜。

我有留意到您的账号在 Cloudflare 上已经使用了一段时间，不知道您目前为止的使用体验如何？非常希望有机会跟您聊一下，为您提供一些有帮助的优化信息，可以在账户和相关配置方面以及业务调整方面能帮到您，让您有一个最佳的体验。

您可以添加我签名中的任何联系方式：
\n<redacted>

如果您方便的话，我真诚希望就账户和相关配置和您做个简单的沟通。如您平日业务繁忙，是否能麻烦您帮忙引荐一下其他负责技术方面的同事跟我对接。

期待您的回复，谢谢！
\n顺祝商祺！

可能以为我是 XJTU 的雇员，然而我是 one-man :)

美国公司就是会做生意，这种营销邮件不像某些公司那样谈钱，让你买买买、升级，CF 只是说：

\n
我真诚希望就账户和相关配置和您做个简单的沟通。
\n

让人觉得非常温馨，我要有钱了肯定会花钱的。

第一次 May 11, 2024 (Asia/Shanghai)

Fri May 10 2024, 18:58:05 CEST
\n空心菜 1:04 am

刚才有点诡异

服务器，容器都没有重启，遇到 502 错误，突然高负载甚至 discourse 出现 extreme load 的横幅

第二次 May 13, 2024 (Asia/Shanghai)

Mon May 13 2024, 03:47:59 CEST
\n空心菜 10:14 pm

我怀疑我们网站刚才是被 DDoS/CC 攻击了

空心菜 10:16 pm

刚才服务器压力巨大，我把唯一暴露在公网的 web 服务器 caddy 给停掉就好了

空心菜 10:18 pm

在我发现这个问题之后，停掉了 caddy，这段时间浏览器应该显示无法连接。我在这段时间配置了使用 cloudflare argo tunnel，通过 CF 网络访问本站，保证公网 443 端口没有东西

我昨天还怀疑可能是 Discourse 程序跑飞了，刚才我测试了重启 caddy 之后立马 cpu 占满，vnstat/iftop 看到异常的流量

好在我的服务器是 6C16G 独服，要是早先的 2C2G 恐怕 SSH 都用不了

空心菜 10:23 pm

从今天开始我将完全依赖 CloudFlare 的保护，至于网速应该没有多大影响，因为原来的服务器在德国，本来就不指望有大陆优化

\n","createdAt":"2024-05-15 15:54:04.140785","updatedAt":"2024-07-19 00:40:49.052376","replyToPostNumber":null,"replyCount":0,"likeCount":7,"wordCount":1312,"liked":false,"bookmarked":false,"polls":[],"reactions":[{"reaction":"magic_wand_grin","count":1,"users":[{"id":30,"username":"一只玉米人","name":"玉米🌽"}],"hasReacted":false},{"reaction":"😰️","count":1,"users":[{"id":151,"username":"Rin","name":"Tomotake Rin"}],"hasReacted":false},{"reaction":"❤️","count":7,"users":[{"id":30,"username":"一只玉米人","name":"玉米🌽"},{"id":151,"username":"Rin","name":"Tomotake Rin"},{"id":307,"username":"Fast","name":null},{"id":346,"username":"hoist","name":null},{"id":1811,"username":"Time_Limit_Exceed","name":null},{"id":1929,"username":"Quit","name":"Qwen"},{"id":4113,"username":"filehelper","name":"文件传输助手"}],"hasReacted":false}],"wiki":false,"version":15,"publicVersion":15,"deletedAt":null,"isAnonymous":false,"user":{"id":4668,"username":"IO","name":null,"avatarUrl":null,"admin":true,"moderator":false,"signatureRaw":"","signatureCooked":null}},{"id":32351,"postNumber":5,"raw":"见证了一段小小网络战斗。\n但是好奇这些人为什么要打别人网站。钱太多了，一时兴起？感觉不像是门中仇人。","cooked":"

见证了一段小小网络战斗。
\n但是好奇这些人为什么要打别人网站。钱太多了，一时兴起？感觉不像是门中仇人。

\n","createdAt":"2024-05-16 00:38:27.551202","updatedAt":"2024-05-16 00:38:27.551202","replyToPostNumber":null,"replyCount":1,"likeCount":0,"wordCount":49,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":346,"username":"hoist","name":null,"avatarUrl":"/uploads/image/0d/cd/0dcdf69d213b6798002779ad4b729567cd4d889ee4a56c07a8c4454e8b563219.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":32353,"postNumber":6,"raw":"从手法上看，攻击者不像非常专业的 cracker，例如他没有扫服务器公网端口的其他服务，只是对 xjtu.app 这个 host 做攻击，攻击过程也是三天打鱼两天晒网，同一次攻击中也是断断续续，且都是半夜/凌晨时分。从 CF 记录的 ip 来看，不像发动某个巨大的僵尸网络来攻击。","cooked":"

从手法上看，攻击者不像非常专业的 cracker，例如他没有扫服务器公网端口的其他服务，只是对 xjtu.app 这个 host 做攻击，攻击过程也是三天打鱼两天晒网，同一次攻击中也是断断续续，且都是半夜/凌晨时分。从 CF 记录的 ip 来看，不像发动某个巨大的僵尸网络来攻击。

\n","createdAt":"2024-05-16 01:11:56.626261","updatedAt":"2024-07-19 00:40:49.255232","replyToPostNumber":5,"replyCount":0,"likeCount":0,"wordCount":112,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":4668,"username":"IO","name":null,"avatarUrl":null,"admin":true,"moderator":false,"signatureRaw":"","signatureCooked":null}},{"id":32354,"postNumber":7,"raw":"所以是打着玩的？😀","cooked":"

所以是打着玩的？😀

\n","createdAt":"2024-05-16 01:20:33.882329","updatedAt":"2024-05-16 01:20:33.882329","replyToPostNumber":null,"replyCount":2,"likeCount":0,"wordCount":8,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":30,"username":"一只玉米人","name":"玉米🌽","avatarUrl":"/uploads/blob/14/96/14961aeaa46ccbb75a61eec0c27b26e74fb5d1c00ccdcbbe898ca9ea37087dd6.svg","admin":false,"moderator":true,"signatureRaw":"*年月擦身过，暂且问，会更好吗？*","signatureCooked":"

年月擦身过，暂且问，会更好吗？

\n"}},{"id":32356,"postNumber":8,"raw":"> **DDoS attacks are illegal**. According to the Federal Computer Fraud and Abuse Act, an unauthorized DDoS attack can lead to up to 10 years in prison and a $500,000 fine. Conspiring to do so can lead to 5 years and $250,000. However, these serious consequences are applicable to attacks launched without permission.","cooked":"

\n
DDoS attacks are illegal. According to the Federal Computer Fraud and Abuse Act, an unauthorized DDoS attack can lead to up to 10 years in prison and a $500,000 fine. Conspiring to do so can lead to 5 years and $250,000. However, these serious consequences are applicable to attacks launched without permission.
\n

\n","createdAt":"2024-05-16 02:04:42.052017","updatedAt":"2024-07-19 00:40:49.315696","replyToPostNumber":7,"replyCount":0,"likeCount":1,"wordCount":53,"liked":false,"bookmarked":false,"polls":[],"reactions":[{"reaction":"🐈️","count":1,"users":[{"id":30,"username":"一只玉米人","name":"玉米🌽"}],"hasReacted":false},{"reaction":"❤️","count":1,"users":[{"id":30,"username":"一只玉米人","name":"玉米🌽"}],"hasReacted":false}],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":4668,"username":"IO","name":null,"avatarUrl":null,"admin":true,"moderator":false,"signatureRaw":"","signatureCooked":null}},{"id":32359,"postNumber":9,"raw":"搞不好就是某个小学生干的。","cooked":"

搞不好就是某个小学生干的。

\n","createdAt":"2024-05-16 04:34:59.910716","updatedAt":"2024-05-16 04:34:59.910716","replyToPostNumber":7,"replyCount":0,"likeCount":0,"wordCount":13,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":1288,"username":"LittleWangInShanghai","name":"小王在上海","avatarUrl":"/uploads/image/63/d2/63d25f4f2f6693f9ab450f32bd8d04e2d29f96a980b51555a585423f113c4a58.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":33741,"postNumber":10,"raw":"更新：第四次被 D\n百万级别请求数\n[grid mode=\"tile\"]\n![Screenshot_20240517_190543|532x425](/uploads/image/7b/ee/7beef4457c452b9b0b05c2e0e7c0a13cddce811dc1065d495eccda41194978c0.avif)\n![image|603x500](/uploads/image/d0/42/d042f15cfbf3be3fbc85ad956e42f1370d335ed1208dea44c051b88849f51e65.avif)\n[/grid]\n#### Top Traffic Countries / Regions\n\nPrevious 24 hours\n\n|Country / Region|Traffic|\n| --- | --- |\n|China|1,514,981|\n|United States|978,837|\n|India|698,209|\n|Hong Kong|473,961|\n|Singapore|469,799|\n\n开 under attack mode 后（负载还是有点大）：\n![image|690x396](/uploads/image/3e/f0/3ef0971a815ed68ee5432738781a3e128b4b45ba15c869d346b2a69eded27609.avif)\n\n弱点分析：\n由于开启了强制用户登陆，没有登陆的用户只能访问 `/login`（访问 `/` 时 301 自动跳转），Discourse 生成这一页面很耗资源（？）并且没有被 CDN 缓存（？）","cooked":"

更新：第四次被 D
\n百万级别请求数

$\"Screenshot_20240517_190543\"$
\n $\"image\"$

Top Traffic Countries / Regions

Previous 24 hours

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Country / Region	Traffic
China	1,514,981
United States	978,837
India	698,209
Hong Kong	473,961
Singapore	469,799

开 under attack mode 后（负载还是有点大）：
\n $\"image\"$

弱点分析：
\n由于开启了强制用户登陆，没有登陆的用户只能访问 /login（访问 / 时 301 自动跳转），Discourse 生成这一页面很耗资源（？）并且没有被 CDN 缓存（？）

\n","createdAt":"2024-05-17 11:16:01.2043","updatedAt":"2024-07-19 00:40:49.384308","replyToPostNumber":null,"replyCount":0,"likeCount":4,"wordCount":118,"liked":false,"bookmarked":false,"polls":[],"reactions":[{"reaction":"😇️","count":1,"users":[{"id":30,"username":"一只玉米人","name":"玉米🌽"}],"hasReacted":false},{"reaction":"😰️","count":1,"users":[{"id":1811,"username":"Time_Limit_Exceed","name":null}],"hasReacted":false},{"reaction":"❤️","count":4,"users":[{"id":30,"username":"一只玉米人","name":"玉米🌽"},{"id":175,"username":"argmin","name":null},{"id":346,"username":"hoist","name":null},{"id":1811,"username":"Time_Limit_Exceed","name":null}],"hasReacted":false}],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":4668,"username":"IO","name":null,"avatarUrl":null,"admin":true,"moderator":false,"signatureRaw":"","signatureCooked":null}},{"id":33745,"postNumber":11,"raw":"![images|397x500](/uploads/image/4d/3e/4d3e14ea28aa656fe7cbaedccb2f5634e5ba247e868516844e9e0e088ac3143b.avif)","cooked":"

$\"images\"$

\n","createdAt":"2024-05-17 12:22:49.731325","updatedAt":"2024-05-17 12:22:49.731325","replyToPostNumber":null,"replyCount":0,"likeCount":1,"wordCount":1,"liked":false,"bookmarked":false,"polls":[],"reactions":[{"reaction":"💯️","count":1,"users":[{"id":30,"username":"一只玉米人","name":"玉米🌽"}],"hasReacted":false},{"reaction":"❤️","count":1,"users":[{"id":30,"username":"一只玉米人","name":"玉米🌽"}],"hasReacted":false}],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":1941,"username":"john","name":"John","avatarUrl":"/uploads/image/5a/04/5a0499fe826e0ab0e29d97bc3d98bbc1dfebf81309f4b4426ae0c7b62bd908e8.avif","admin":false,"moderator":false,"signatureRaw":"自黄药师黄仁勋来，世人皆爱猫。余独爱老鼠之，可爱之态，活泼之动，实为人所难以抗拒。喵~\n\n:mouse_hole: :mouse: :mouse: :computer_mouse: :mouse_trap: :sob_mouse: :sweat_smile_mouse: :sleeping_mouse: :rolling_on_the_floor_laughing_mouse: :revolving_hearts_mouse: :pleading_face_mouse: :nerd_face_mouse: :mouse_hole: :melting_face_mouse: :mask_mouse: :innocent_mouse: :hugging_face_mouse: :frog_mouse: :face_with_cowboy_hat_mouse: :clown_face_mouse: :cherry_blossom_mouse: :cat_mouse:","signatureCooked":"

自黄药师黄仁勋来，世人皆爱猫。余独爱老鼠之，可爱之态，活泼之动，实为人所难以抗拒。喵~

$\":mouse_hole:\"$ 🐁 🐁 🖱️ 🪤 $\":sob_mouse:\"$ $\":sweat_smile_mouse:\"$ $\":sleeping_mouse:\"$ $\":rolling_on_the_floor_laughing_mouse:\"$ $\":revolving_hearts_mouse:\"$ $\":pleading_face_mouse:\"$ $\":nerd_face_mouse:\"$ $\":mouse_hole:\"$ $\":melting_face_mouse:\"$ $\":mask_mouse:\"$ $\":innocent_mouse:\"$ $\":hugging_face_mouse:\"$ $\":frog_mouse:\"$ $\":face_with_cowboy_hat_mouse:\"$ $\":clown_face_mouse:\"$ $\":cherry_blossom_mouse:\"$ $\":cat_mouse:\"$

\n"}},{"id":34082,"postNumber":12,"raw":"## 第四次\n\n![Screenshot_20240523_090035|545x500](/uploads/image/b5/f7/b5f78d35a230225285012ecfde1b6d8c2b95c156b2d0990b69ce60536ed46570.avif)\n[date=2024-05-23 time=09:10:44 timezone=\"Asia/Shanghai\"] 凌晨又来了一次，流量 245G，请求高达 68M（又是 [上次](/t/topic/12141/9) 的 10 倍）\n\n根据 CloudFlare 的日志，这次攻击持续时间为 ~ May 23, 2024 12:58:11 AM (GMT+8)，攻击流量最多的来自 South Africa，很多 IP 为欧洲国家，尤其是德国（有人用 Hetzner）：\n[grid mode=\"tile\"]\n![Screenshot_20240523_090943|690x304](/uploads/image/9c/b6/9cb65efd59aa403e80f0fea84b9754f92072b47983ca950087b20ed758c48e3f.avif)\n\n![Screenshot_20240523_090815|690x472](/uploads/image/c4/b0/c4b0614c372e0d8dca510d99828fda9d110df32071fbc91877064cf60b70914b.avif)\n[/grid]\n\n\n\n可能是 [防护措施](/t/anti-ddos-tactics/12618) 得当，这次只是在最开始的时候收到了 RAM 告警（甚至都未达到 critical 级别），一分钟后就恢复了。\n\n[grid]\n![Screenshot_20240523_090314|581x500](/uploads/image/54/8e/548e23523767fdc99cc304bcee650b30599e60b7a80507a92f997009357f33b2.avif)\n![Screenshot_20240523_090321|581x500](/uploads/image/8e/65/8e6572763e2e5fc3b6d76ef734711f1e5660cbe7788a613d4596eb1347b531ed.avif)\n[/grid]","cooked":"

第四次

$\"Screenshot_20240523_090035\"$
\nMay 23, 2024, 9:10:44 AM (Asia/Shanghai) 凌晨又来了一次，流量 245G，请求高达 68M（又是上次的 10 倍）

根据 CloudFlare 的日志，这次攻击持续时间为 ~ May 23, 2024 12:58:11 AM (GMT+8)，攻击流量最多的来自 South Africa，很多 IP 为欧洲国家，尤其是德国（有人用 Hetzner）：

$\"Screenshot_20240523_090943\"$

$\"Screenshot_20240523_090815\"$

可能是防护措施得当，这次只是在最开始的时候收到了 RAM 告警（甚至都未达到 critical 级别），一分钟后就恢复了。

$\"Screenshot_20240523_090314\"$
\n $\"Screenshot_20240523_090321\"$

\n","createdAt":"2024-05-23 01:02:12.137262","updatedAt":"2024-07-19 00:40:49.469392","replyToPostNumber":null,"replyCount":2,"likeCount":0,"wordCount":145,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":3,"publicVersion":3,"deletedAt":null,"isAnonymous":false,"user":{"id":4668,"username":"IO","name":null,"avatarUrl":null,"admin":true,"moderator":false,"signatureRaw":"","signatureCooked":null}},{"id":34084,"postNumber":13,"raw":"牛逼","cooked":"

牛逼

\n","createdAt":"2024-05-23 01:11:54.554827","updatedAt":"2024-05-23 01:11:54.554827","replyToPostNumber":12,"replyCount":0,"likeCount":0,"wordCount":2,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":1892,"username":"AI","name":null,"avatarUrl":"/uploads/image/75/41/75410526aa87e9fdc9a80a8704ef1f3c294b168936bfca9452075beb5a122449.avif","admin":true,"moderator":true,"signatureRaw":null,"signatureCooked":null}},{"id":41453,"postNumber":14,"raw":"[quote=\"shared_user, post:12, topic:12141, username:anonymous_coward\"]\n有人用 Hetzner\n[/quote]\n\n能举报滥用么？\n我现在博客已经完全禁止了境外 IP 访问 :halo:","cooked":"

\n\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\tshared_user:\n\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t

\n
有人用 Hetzner
\n

\n\t\t\t\t\t\t

能举报滥用么？
\n我现在博客已经完全禁止了境外 IP 访问 😇

\n","createdAt":"2024-10-09 09:28:59.46025","updatedAt":"2024-10-09 09:28:59.46025","replyToPostNumber":12,"replyCount":1,"likeCount":0,"wordCount":34,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":5151,"username":"Soyo34325","name":"Soyo34325","avatarUrl":"/uploads/image/9d/e5/9de500d3afb55c0fe71e319832f2af75532222efe94bd3de9aea21f0f5c55707.avif","admin":false,"moderator":false,"signatureRaw":"ぜーんぶ弾けなーい！","signatureCooked":"

ぜーんぶ弾けなーい！

\n"}},{"id":41454,"postNumber":15,"raw":"举办了，冇用，就填了个表，没有下文了","cooked":"

举办了，冇用，就填了个表，没有下文了

\n","createdAt":"2024-10-09 11:42:29.883218","updatedAt":"2024-12-22 15:08:05.695328","replyToPostNumber":14,"replyCount":0,"likeCount":0,"wordCount":18,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":4668,"username":"IO","name":null,"avatarUrl":null,"admin":true,"moderator":false,"signatureRaw":"","signatureCooked":null}}],"hasMore":false,"lastReadPostNumber":10,"hasUrlPostNumber":true}