February 18, 2016
If you're obsessive like I am, you've noticed that nyaatorrents has been up and down. Yesterday I got curious so I left a copy of pingplotter running monitoring it.
It's interesting. The route comes up and down a lot, but the point that's breaking isn't the last step, not even close. It's a step named "staminus.net", about 7 steps before nyaa.se (a synonym).
Anyway, all last night, the pattern was that this link would be down for 20 minutes or half an hour, then come up for a few seconds (typically half a minute but sometimes up to 4 minutes) and then go down again. I suspect someone there is working on a fix for something; they bring it up briefly for a test, which has always failed, so they bring it down again and work on it some more.
The web site for staminus.net says it's all about protecting customers from DDOS's. I wonder if someone has been trying to attack Nyaatorrents, and the guys at Staminus are trying to find an adequate block rule?
The site came up again this morning about 9 (my time) and just went down again at 2 (my time) so I guess they're making another try. Unless they find an answer, probably it's going to be up-and-down all night again, mostly down.
UPDATE: I assume that the global routing announcement for "nyaatorrents.org" and "nyaa.se" is to send it to staminus.net, which is rerouting it to the actual server farm that hosts nyaa.se, located in Montreal.
That's pretty elaborate for what is basically a hobby site. Did nyaatorrents get attacked by a DDOS before, forcing them to take this kind of action?
If I remember correctly, they have been DDOS'd before, but it wasn't recently... more like months ago. If this is a reaction to that, it's awfully delayed.
Posted by: Wonderduck at February 18, 2016 04:05 PM (KiM/Y)
I'm thinking that this is a new one, but that they started using Staminus because of the last one.
There are criminal gangs in eastern Europe who use DDOS threats as part of protection rackets "pay us or we bring your server down" and this may be another such attack like the last one.
Nyaatorrents is a business, albeit not a very big one. The only advertiser I've ever noticed is JList, though my ad blocking may have stopped all the others so I might be wrong. Anyway, it's possible their cash flow is a couple thousand a month, and they may be viewed as being worth shaking down.
It's been down for about three hours now and it's come up briefly five times. I'm pretty sure that this is some sort of testing.
Posted by: Steven Den Beste at February 18, 2016 04:46 PM (+rSRq)
Gad, is there anything that isn't in Wikipedia? It says that Nyaatorrents was DDOS'ed last September.
Posted by: Steven Den Beste at February 18, 2016 04:49 PM (+rSRq)
Posted by: Steven Den Beste at February 18, 2016 07:44 PM (+rSRq)
Posted by: muon at February 19, 2016 09:44 PM (eSlVg)
Posted by: Steven Den Beste at February 19, 2016 09:49 PM (+rSRq)
Posted by: Steven Den Beste at February 20, 2016 12:28 PM (+rSRq)
But I do wonder whether at some point the cure is worse than the disease. The doctors have brought the site down more thorougly than anything the hostiles ever did.
Perhaps the problem wasn't so much outright killing the server as it was drastically increasing its bandwidth usage, resulting in huge monthly bills from the hosting service?
Posted by: Steven Den Beste at February 20, 2016 12:42 PM (+rSRq)
Posted by: muon at February 22, 2016 04:54 AM (IUHrD)
Enclose all spoilers in spoiler tags:
[spoiler]your spoiler here[/spoiler]
Spoilers which are not properly tagged will be ruthlessly deleted on sight.
Also, I hate unsolicited suggestions and advice. (Even when you think you're being funny.)
At Chizumatic, we take pride in being incomplete, incorrect, inconsistent, and unfair. We do all of them deliberately.
22 queries taking 0.0061 seconds, 28 records returned.
Powered by Minx 1.1.6c-pink.