4 ms·

4 TB per month isn't really a DDoS attack, no? 4 TB per hour might qualify as a DDoS, but 4 TB per month is just 1.5 MB / second. 6 million requests per months

4 TB per month isn't really a DDoS attack, no? 4 TB per hour might qualify as a DDoS, but 4 TB per month is just 1.5 MB / second. 6 million requests per months are just 2 requests per second. I'd say the fact they run a monolith service isn't really relevant at this scale, especially as I assume Cloudflare handles most of the requests through caching them at the CDN level.

saagarjha 3y ago
I guess that depends on how irregular the traffic is.
- ThePhysicist 3y ago
  Sure, if every request triggers a very complex database transaction or computation, but if I understand correctly this is a simple file download endpoint that's probably cacheable.
  - n4r9 3y ago
    I think OP means that the 6 million requests might not be evenly spread. They might only occur during 5 minutes of each day, for example. I don't know enough to know whether that's feasible.
tbarbugli 3y ago
I think its around 1TB a day, but indeed still very small.
- tutfbhuf 3y ago
  Yes, you can rent a few dollar VPS from e.g. Hetzner (since Germany is mentioned in the blog post), and run a few wget commands in parallel in a loop on their 200MB setup file to easily reach 1TB a day. For a company, this should definitely not be something to worry about. However, if I were able to single out individual IPs that are attacking me, then I would simply block them, report them (use the abuse form from the hoster of the attacking IP), and call it a day. This way, you can at least hope that the hoster will do something about it, either by kicking the hacker off its platform or, if it is some kind of service reflection attack, inform the victim to close the security loophole on their server and remove themselves from the botnet. If your attacks originate from a vast amount of different IPs from Russia and China, consider geoblocking.
  - tamrix 3y ago
    The worst thing reporting an IP can do is increase your ranking on scamalitics. Cgnat is becoming common on home internet. You can share an IP with up to 128 other people.
    - supriyo-biswas 3y ago
      scamalytics has nothing to do with a report to the tech-c or abuse-c email address in the WHOIS information.
    - tutfbhuf 3y ago
      On Hetzner, you receive an abuse email with the directive to respond appropriately if your root server or VPS is involved in some kind of abuse related issue. In larger companies this happens quite frequently. I'm not sure what would happen if you ignore such email.
      - justsomehnguy 3y ago
        Just reply what you are sorry and you are fixing/fixed the issue. Till the next report.
      - Pi9h 3y ago
        Hetzner will usually give you 24 hours to respond to abuse reports. Failure to do so will lead to locking of your server IP.
- praseodym 3y ago
  That would cost you $200-$400 per day when hosting at Netlify or Vercel, which can quickly impact the bottom line of a startup or small business.
buro9 3y ago
Given that the vast majority of the web are Wordpress sites (or Drupal if you're a larger Org) that are on $5-20 per month multi-tenant hosts, have not installed caches, and speak directly to the database... the vast majority of sites on the internet can be knocked offline by merely doing 4 requests per second. That sounds crazy, right? But yet that's where we are. Context: I used to manage the DDoS protection at Cloudflare, and also the WAF, Firewall and some customer facing security projects, and we frequently either saw that web scraping took customers offline, or trivial and very low volume HTTP request rates took customers offline. In the early days we considered anything to be a DoS when it threatened our infra, but the threshold for customers is barely higher than a few concurrent and active users. The big numbers always make headlines, but it's the small numbers which most people feel.
- denton-scratch 3y ago
  > have not installed caches Drupal, in particular, is notorious for having multiple layers of cacheing out of the box. Of course, you can always add some extra caches...
- rrr_oh_man 3y ago
  FYI: Most decent Wordpress hosters these days have cache, SSL, minification out of the box. My favourite WP hosters: - kinsta.com (for scaling & multi-sites) - raidboxes.io (amazing customer support, usually within 15min, even on a Sunday)
  - buro9 3y ago
    Decent Wordpress hosters always had this, but the majority of Wordpress sites were (and probably still are) just droplets, Linode, Hetzner, etc.
    - gustavorg 3y ago
      Sir, I have my pompous site on linode and feel offended and hurt.
croes 3y ago
At least 8TB. 4TB is UK only.
MartijnHols 3y ago
A Denial of Service attack could be mere KBs per a hour. If they trigger a heavy API endpoint on the target service, that may be enough to take the service down. The Distributed part just means multiple machines are attacking at the same time. No part of a DDOS requires the throughput to be gigantic, although the big ones are typically the ones you will find in the news. One possible aim of this attack is to either burn through the bandwidth quotum of the source servers, or to use so much bandwidth that it becomes unaffordable. This could be done very cheaply with just a single or few attacking machines. Most datacenters and hosting providers have bandwidth limits or start charging after a certain amount, and too often the company being attacked only finds out when they receive a bill they can't afford.
fireant 3y ago
I have a website with a game download that has maybe 50 players total. Nobody uses it. I'm fairly certain that actual people downloading the game is maybe a few per month. Yet from this 2GB zip file I've had 5TB traffic over the last month and this has been going on for years. This is no "DDOS", it's just misconfigured bots/crawlers going through all the links and being unable to cancel downloads.

saagarjha 3y ago

I guess that depends on how irregular the traffic is.

ThePhysicist 3y ago
Sure, if every request triggers a very complex database transaction or computation, but if I understand correctly this is a simple file download endpoint that's probably cacheable.
- n4r9 3y ago
  I think OP means that the 6 million requests might not be evenly spread. They might only occur during 5 minutes of each day, for example. I don't know enough to know whether that's feasible.

tbarbugli 3y ago

I think its around 1TB a day, but indeed still very small.

tutfbhuf 3y ago
Yes, you can rent a few dollar VPS from e.g. Hetzner (since Germany is mentioned in the blog post), and run a few wget commands in parallel in a loop on their 200MB setup file to easily reach 1TB a day. For a company, this should definitely not be something to worry about. However, if I were able to single out individual IPs that are attacking me, then I would simply block them, report them (use the abuse form from the hoster of the attacking IP), and call it a day. This way, you can at least hope that the hoster will do something about it, either by kicking the hacker off its platform or, if it is some kind of service reflection attack, inform the victim to close the security loophole on their server and remove themselves from the botnet. If your attacks originate from a vast amount of different IPs from Russia and China, consider geoblocking.
- tamrix 3y ago
  The worst thing reporting an IP can do is increase your ranking on scamalitics. Cgnat is becoming common on home internet. You can share an IP with up to 128 other people.
  - supriyo-biswas 3y ago
    scamalytics has nothing to do with a report to the tech-c or abuse-c email address in the WHOIS information.
  - tutfbhuf 3y ago
    On Hetzner, you receive an abuse email with the directive to respond appropriately if your root server or VPS is involved in some kind of abuse related issue. In larger companies this happens quite frequently. I'm not sure what would happen if you ignore such email.
    - justsomehnguy 3y ago
      Just reply what you are sorry and you are fixing/fixed the issue. Till the next report.
    - Pi9h 3y ago
      Hetzner will usually give you 24 hours to respond to abuse reports. Failure to do so will lead to locking of your server IP.
praseodym 3y ago
That would cost you $200-$400 per day when hosting at Netlify or Vercel, which can quickly impact the bottom line of a startup or small business.

buro9 3y ago

Given that the vast majority of the web are Wordpress sites (or Drupal if you're a larger Org) that are on $5-20 per month multi-tenant hosts, have not installed caches, and speak directly to the database... the vast majority of sites on the internet can be knocked offline by merely doing 4 requests per second. That sounds crazy, right? But yet that's where we are. Context: I used to manage the DDoS protection at Cloudflare, and also the WAF, Firewall and some customer facing security projects, and we frequently either saw that web scraping took customers offline, or trivial and very low volume HTTP request rates took customers offline. In the early days we considered anything to be a DoS when it threatened our infra, but the threshold for customers is barely higher than a few concurrent and active users. The big numbers always make headlines, but it's the small numbers which most people feel.

denton-scratch 3y ago
> have not installed caches Drupal, in particular, is notorious for having multiple layers of cacheing out of the box. Of course, you can always add some extra caches...
rrr_oh_man 3y ago
FYI: Most decent Wordpress hosters these days have cache, SSL, minification out of the box. My favourite WP hosters: - kinsta.com (for scaling & multi-sites) - raidboxes.io (amazing customer support, usually within 15min, even on a Sunday)
- buro9 3y ago
  Decent Wordpress hosters always had this, but the majority of Wordpress sites were (and probably still are) just droplets, Linode, Hetzner, etc.
  - gustavorg 3y ago
    Sir, I have my pompous site on linode and feel offended and hurt.

croes 3y ago

At least 8TB. 4TB is UK only.

MartijnHols 3y ago

A Denial of Service attack could be mere KBs per a hour. If they trigger a heavy API endpoint on the target service, that may be enough to take the service down. The Distributed part just means multiple machines are attacking at the same time. No part of a DDOS requires the throughput to be gigantic, although the big ones are typically the ones you will find in the news. One possible aim of this attack is to either burn through the bandwidth quotum of the source servers, or to use so much bandwidth that it becomes unaffordable. This could be done very cheaply with just a single or few attacking machines. Most datacenters and hosting providers have bandwidth limits or start charging after a certain amount, and too often the company being attacked only finds out when they receive a bill they can't afford.

fireant 3y ago

I have a website with a game download that has maybe 50 players total. Nobody uses it. I'm fairly certain that actual people downloading the game is maybe a few per month. Yet from this 2GB zip file I've had 5TB traffic over the last month and this has been going on for years. This is no "DDOS", it's just misconfigured bots/crawlers going through all the links and being unable to cancel downloads.