My first "something" attack

NOTE: The first title to this post was “my first DOS attack” which is what it appeared to be to me…now WordPress support has weighed in, so we don’t know exactly what it is….see follow up below.

UPDATE3: Looks like it is over, whatever it was. It fell off the radar yesterday 09/22 and has not returned.

Some readers may have noticed that my hit counter has been flying lately. Shortly after posting the 4th million real traffic count, it took off like a rocket. Initially I had attributed the increase to having the NASA “press conference on the state of the sun” story posted on Glenn Reynolds “Instapundit” which is known to make huge traffic increases.

But something odd happened, the post that was getting all the traffic had nothing to do with that story. Also, there was no trackback URL that indicated that the post getting all the attention was linked or referenced at some high traffic site like CNN or Drudge. The post that was getting all the traffic was a story and analysis I did some months ago about the differences in global temperature anomalies tending to be offset different. It turned out that GISS was much higher than UAS, RSS, or HadCRUT due to GISS choice of continuing to use an outdated baseline period instead of a more current one like the other metrics.

Here is the traffic report:

Blog Stats Increase due to DOS “something”

Saturday 09/20     23,486

Sunday   09/21     20,802 25,319

Monday  09/22     1,006

That specific post about the way the four global temperature anomaly metrics are presented differently created some angry rhetoric with some other bloggers, and there was also some bad behaviour from a specific commenter that I won’t go into except to say that person is no longer welcome here.

Since most DOS attacks tend to focus on the main URL, and since this DOS attack focused on the one specific story URL that made a few folks very angry, I’ll have to conclude that there is a connection. This DOS attack may have been aimed at creating a violation of the Terms of Service, so that WP would shut me down for “stuffing my own traffic”. Fortunately that’s been recognized for what it is and won’t happen now.

You know you’ve really “arrived” when you start getting DOS attacks that are content specific, I’ll wear it as a badge of honor, much like when newspaper and TV journalists get their first death threat for doing a story somebody doesn’t like. Some newsrooms order a cake with black frosting and skull and crossbones to celebrate. As a TV meteorologist, I never had a death threat over the weather, but I’ve been present to two in newsrooms that I recall.

For now, I’ve moved the post elsewhere to a new URL, and the attack has stopped. WordPress support is tracking back through cyberspace to nab the culprit. I don’t much care for these juvenile shenanigans, but it’s just a minor annoyance at this point. It’s more amusing than damaging.

But I thought I should let everyone know why I have had the sudden jump in “popularity”. When I do my end of month report, I’ll adjust the numbers accordingly to get an accurate count. It is funny how this worked out, a story showing the biggest baseline different at GISS compared to other metrics has caused me to question and possibly adjust my own numbers.

UPDATE: My first change only briefly stopped the attack, so we’ve gone to “plan b” Sunday numbers have been added to to reflect the moment, up from 18k earlier. Also note that in a large scale DOS attack, the numbers would be much higher. The numbers you see are only what gets through wordpress security to post spam comments and attempts at spam posts.

FOLLOW UP: I got the word from WordPress support on this:


Hi,

Our stats expert has had a look and found no evidence of a DoS or anything untoward.  He says “the most plausible reason is an email newsletter featuring the URL, or else some other non-browser app loading the URL such as a feed reader. I have not been able to find any evidence of of a DDOS attempt or other “foul play.”

Separately, I’ve checked our security logs and see no other signs of activity that would normally indicate a blog under attack.

In short: we’re quite sure the traffic is genuine and doesn’t correspond with an attack of any kind.

Kind regards,

Alex

WordPress Support

And also this:

Hi Anthony,
We don’t know where the traffic is coming from; all I can tell you is that our stats guys believe it is organic (i.e. genuine browser traffic, not from a single source, not a bot or script or other automated trickery).  We can speculate as to possible reasons but there’s no way for us to confirm or identify them.

What we are sure of is that there’s no danger to your blog or WordPress.com.  It’s not at all unusual for popular blogs to get a sudden surge in traffic for no obvious reason (and from no single identifiable source).

I don’t think there’s anything to fix or worry about: one of your posts is getting a lot of traffic for indeterminate reasons, and your stats accurately reflect that.

Kind regards,

Alex

WordPress Support


Odd, very odd. Maybe I’m just being pigheadedly cautious, but you’d think somebody would let me know where this traffic is coming from if it was in a newsletter or feed reader as they suggest. With nearly 50,000 new hits on a specific post, I have not picked up a corresponding amount of comments, which makes me “skeptical” about this traffic being real. Or, perhaps it really is from Instapundit as I thought originally, but its from some un-trackable web mechanism. The traffic continues even as I write this follow up. But we are seeing a drop now. – Anthony

0 0 votes
Article Rating

Discover more from Watts Up With That?

Subscribe to get the latest posts sent to your email.

79 Comments
Inline Feedbacks
View all comments
September 21, 2008 1:34 pm

I was tracking the stats on this and the really sad part is that the amount of traffic the perps threw at Anthony would hardly be a blip on the total traffic on WordPress’ servers. All the traffic is load-balanced between a cloud of web servers accessing the common database containing all the posts and comments.
If this is the best the AGWer’s can do for computer experts, no wonder the GCMs aren’t accurate.

David Walton
September 21, 2008 1:48 pm

Re Werner Weber’s coments:
Uh, yeah, Goths, Vandals and Huns were not vicious, effective, armed warriors who invaded, defeated, burned, pillaged, and raped the landscape and everything on it to feed themselves. (Granted, some subsequently stayed in place and melded with the what was left of the people they defeated.)
It was ineffective Christian bureaucrats who brought about a culture of invasion, robbery, and slaughter upon themselves.
Frankly, I do not believe that Gibbon or Voltaire were such fools as to believe such a simplistic and silly scenario.

Simon
September 21, 2008 1:51 pm

I had no idea what I was reading about today, I too had to look it up…
It makes me feel old.
Werner weber,
Surely the longevity of the Eastern Roman/Bysantine Empire disproves your case against Christianty per se being the cause of the fall of Rome?

Mike M.
September 21, 2008 1:57 pm

Hey, kim, I’ll bet it was Dano from the Dotearth Lynch Mob!
Congratulations, Anthony!

September 21, 2008 2:08 pm

The International Journal of Inactivism seems to be confusing me with Anthony over my I Am A Skeptic post.
Perhaps I am next? Stay Tuned!

George Bruce
September 21, 2008 2:12 pm

Congratulations.
I will make a small donation to celebrate.

September 21, 2008 2:38 pm

To David Walton:
I am quoting Gibbon. Incidentally, French revolution turned rather openly anti-christian, under the influence of intellectuals such as Voltaire.
To Simon:
There was a difference between eastern and western part of the empire. The western part abandoned Greek as official language, and no book in greek language has survived in Western Europe during middle ages. At Constantinople, the university was kept in operation.
However, the eastern empire barely survived the first islamic wave, where they lost what is now Syria, Palestine, Egypt, Tunisia.

September 21, 2008 2:46 pm

[…] most likely by a college student who is the son of a TN Dem. politician, by to the Dos attack on a post at Watt’s Up With That that some script kiddies apparently found offensive.  When something doesn’t fit the […]

M White
September 21, 2008 2:46 pm

Final episode of THE CLIMATE WARS. Dr Iain Stewart investigates climate models but there’s a problem, the models show changes are slow and steady but historical data indicates sudden changes taking place over a few years.
In episode two Dr Stewart ‘proves’ the Medieval Warm period (800 – 1300AD according to wikipedia) did not exist, hockey stick says no. In episode three he demonstrates how sudden climate change can destroy a civilisation.
The ANASAZI tribe of North America disappeared around 1300AD. He then goes on and tells us that this was due to sudden climate change which made the water supply dry up.
So the Anasazi civilization disappears in 1300AD the time that the medieval warm period gave way to the little ice age. This guys got a PHD but apparently can’t see the connection. All the gear no idea.
All three episodes should be available on the BBC website soon
http://www.bbc.co.uk/programmes/b00djvq9
Also, when the Goths went into Rome they considered themselves to be Roman citizens and were christians. They were looking for a home within the Roman Empire, eventually crossing the straights of Gibralter and settling in North Africa.

Bill Marsh
September 21, 2008 2:57 pm

Is the attack originating from one URL or several? You may have trouble stopping it if the person knows what they are doing and has a small to medium sized Botnet available. If someone is really serious they’ll use a Botnet and rotate the attacking bots so it is really hard to stop.

Bill Marsh
September 21, 2008 3:13 pm

M White,
“when the Goths went into Rome they considered themselves to be Roman citizens’
That would be the reason they slaughtered a Roman army and killed the Roman Emperor Valens in 378 AD (Alaric the Gothic King took Rome from the Romans in 410AD, subsequently the Roman capital was moved to Ravenna and this was sacked in 476AD, ending the Western Roman Empire)? I’d say that the Goths did NOT consider themselves roman citizens since they swore fealty to Alaric, not Piscus Attalus, the puppet Roman Emperor Alaric appointed as ‘Emperor’. True, Alaric was the ‘master of Soldiers’ in Rome, but he was not a Roman Citizen, his frustration with Rome’s lack of accommodation , finally sacked the city in 410AD. After that I suppose the Visigoths were ‘Roman’. 🙂

September 21, 2008 3:33 pm

OT
Coldest September minimum EVER recorded here in Perth Western Australia this morning. People reporting scrapping ice of car windows. The weather is suppossed to be warming this time of year not cooling. I blame Golbal Warming myself.

Bill Marsh
September 21, 2008 3:41 pm

OT – Is this a Cycle 24 sunspot at long last on the Magnetogram here
http://sohowww.nascom.nasa.gov/data/realtime/mdi_mag/1024/latest.html

Yaakoba
September 21, 2008 4:36 pm

Your website has offered a lot of unteresting insights. And has been so very helpful during the past hurricanes to ease the worry with these storms.
I guess someone is jealious of your good quality.
People that hurt other people by trying to destroy the good in others, are very troubled people.
Your website draws a lot of good people.
Everyone who is good who reads your website should take a minute of silence and offer a prayer for the repair of our world.
Don’t let the dark snuff out the light.
Stay in the boat.

David Walton
September 21, 2008 4:46 pm

Re: To David Walton:
I am quoting Gibbon. Incidentally, French revolution turned rather openly anti-christian, under the influence of intellectuals such as Voltaire… etc.
So? What does that have to do with you original statement, “I protest againgst depicting the Goths, Vandals and Huns as barbarians” etcetera, etcetera?
This is the defense of your original complaint? Sorry, but your notion that dysfunctional Christians are responsible for the invading hordes of vandals or even Islamics is silly. Gibbon make no such claim that I know of. They may have failed at a defense, or at rallying support in a tumultuous and wicked age but to suggest they were responsible for the invaders is simply ridiculous.
Gibbon at most lays responsibility for an ineffective response to invaders and a collapse from corruption within. Where does he indicate corrupt and inept Christian rulers aided and invited destruction and havoc from independent invaders with their own agendas?
The great intellectual Voltaire also said “Within 100 years of my death, Christianity will be swept from existence and will have passed into history.”
Yeah, like that happened.
Now, I am no Christian, nor do I wish to defend a bloody history done in the name of that religion. But you sir, protest at calling a Goths, Vandals and Huns barbarians? Oh, come now.

Editor
September 21, 2008 4:50 pm

If Greenpeace can climb a smokestack to paint insulting graffiti on it, then surely someone can run a botnet to attack a blog that has criticized Dr. Hansen. Computers
were so much more fun back when “hacker” was a badge of honor.
Not much point in speculating about the source, so I won’t.
How about putting out a press release “Popular Skeptic Climate Change Website under Attack” “Persons unknown have started a Denial of Service (DoS) attack aimed at a particular critical of inconsistencies in Climate data maintained by Dr James Hansen of NASA’s Goddard Research Center.”
Instead of shutting you down, use them to increase readership.

dipole
September 21, 2008 5:08 pm

I believe James Hansen has a reliable algorithm to correct your traffic for the UHI (Unwanted Hacker Intrusion) effect, which has the advantage that the adjustment can send your figures even higher.

Mark Nodine
September 21, 2008 5:41 pm

John Phillips (13:29:32) : Oh, and speaking of schoolboy errors, your headline on the Christy and Douglass paper is factually wrong. The paper does not claim CO2 forcing peaked in 1998,
Sorry, Anthony, but I have to agree with John’s point. The Douglass and Christy paper says that the temperature anomalies reached a peak in 1998, not the CO2 forcing. In fact, the CO2 forcing was specifically modeled as the linear term of the regression after accounting for both the ENSO and aerosol effects. A linear term obviously does not reach a maximum.

September 21, 2008 5:41 pm

With all due respect, Anthony, I don’t think you’re truly “qualified” to “adjust” your blog’s data.
Why don’t you send it to the real pros of data adjustment, Mr. Hansen and Mann et al. They can’t but do a first class job on it, can’t they? 😀

September 21, 2008 5:53 pm

Just a quick note to reassure readers: there’s no chance this blog will be shut down either due to a DoS attack or “traffic stuffing”. We’re not even sure that there’s anything mischievous happening, but we’ll look into it.
– Alex, WordPress.com staff.

doug janeway
September 21, 2008 6:09 pm

“That specific post about the way the four global temperature anomaly metrics are presented differently created some angry rhetoric with some other bloggers. . .”
The truth hurts and even angers. Too bad they can’t handle it like adults.

September 21, 2008 6:26 pm

If and when they catch him, he ought to be lapidated.

Glenn
September 21, 2008 6:42 pm

Mark Nodine (17:41:28) :
“John Phillips (13:29:32) : Oh, and speaking of schoolboy errors, your headline on the Christy and Douglass paper is factually wrong. The paper does not claim CO2 forcing peaked in 1998,”
“Sorry, Anthony, but I have to agree with John’s point. The Douglass and Christy paper says that the temperature anomalies reached a peak in 1998, not the CO2 forcing. In fact, the CO2 forcing was specifically modeled as the linear term of the regression after accounting for both the ENSO and aerosol effects. A linear term obviously does not reach a maximum.”
What Anthony actually said was “In it, a bold claim is made about the likelihood that the atmosphere no longer shows the characteristic of CO2 radiative forcing, and that the effect apparently peaked around 1998.”
The characteristic of CO2 forcing is positive feedback. With no feedback, we get little if any temp increase. From the abstract,
“These effects do not have the signature associated with CO2 climate forcing. However, the data show a small underlying positive trend that is consistent with CO2 climate forcing with no-feedback.”
This of course in reference to the subsequent 10 years after 1998 when temps have not increased.
Anthony didn’t make a “schoolboy” error.

hyonmin
September 21, 2008 6:43 pm

Call Al he knows what to do with all this tech stuff.

September 21, 2008 6:49 pm

The “four global temperature anomaly metrics” [plus the Argos deep sea buoys]. I never get tired of looking at this chart: click
I’m a big believer in visual aids. They put everything in perspective.

Verified by MonsterInsights