[russellw]

... and it continued into this morning.
For those who don't want technical details, look away now.

The 'normal' issues we get occur where attempts are made to slow the server down with lots of page requests coming from a single IP address or a cluster of close IP addresses using automated software. A bit like what a legitimate 'bot' does but with a lot more requests. This means that the server is trying to deliver thousands of page loads per minute and simply doesn't have the grunt to do it and slows down to the point of being unusable. These are reasonably easy to fix because once the IP range is identified it can be blocked before they ever get to the server.

More recently, these people have been getting smarter. There is an ISP (and I use the term loosely) called Host Royale that is now being used to do similar attacks to those above but from lots of random IP addresses in countries like UK/USA/Australia and Canada and each IP address only does a handful of concurrent requests so it's almost impossible to block them all without logging all the attempts and then finding ranges to block like: 45.66.0.0/16 or 46.161.11.0/24.

The latest method seems to be to just use those host ranges to attempt to brute force access to the server (the last couple of days) and as these attempts don't actually hit the forum database. it's the network interface that gets hammered so that while the server is running fine, you can't get to it. I've installed software this morning to automate blocking of those attempts at the perimeter but it is also likely it may clobber some legitimate users, particularly those using static IP addresses or VPNs.