On the night of June 14, I tried to open my blog and found that it was suddenly unreachable. I check the front end of my site almost every day, so this was the first time I had run into anything like it. My first thought was that something had gone wrong with the server or the control panel. Being attacked was only my second guess.
After checking, the cause turned out to be clear: it was not a server malfunction. The Tencent Cloud server running my blog was under a DDoS attack.
Before this, I had only heard about other bloggers getting hit and watching their sites stay offline for a long time. I always assumed a small, non-commercial personal blog like mine would not be worth targeting, so I never put any serious protection in place and left the server IP exposed. Launching a DDoS attack costs money, after all. Looking back, that assumption was obviously naive.
I asked a friend what to do, and he told me to shut the server down first. At the time, I did not take it too seriously. I thought maybe it would be a one-time hit and then stop. But the next day the attacks continued, and the server ended up in a blackhole period.
Some friends suggested asking the hosting provider whether the IP could be changed, and others told me to use Cloudflare to hide the origin IP. That was actually the first time I had really looked into this overseas anti-DDoS service. After checking it, I realized I would need to change the domain’s DNS settings. I hesitated because my original DNS also handled email-related records. It could be changed, of course, but switching things back and forth felt like a hassle. On top of that, Cloudflare is not especially friendly for users accessing sites from mainland China.
In the end, I migrated the entire site to an Alibaba Cloud server and enabled Cloudflare to hide the origin IP. But because I am a bit obsessive about this kind of thing, I later switched the DNS back to Alibaba Cloud’s DNS. During that switch, the Alibaba Cloud server IP ended up being recorded in the domain’s historical DNS resolution records.
And then, sure enough, the next night both the Tencent Cloud server and the Alibaba Cloud server were hit by DDoS attacks at the same time. That went on for another two days.
At one point I even considered buying yet another server. There were promotional sales going on around the 618 shopping period, including on Tencent Cloud, but the discounts were not that great. Then I looked at how much money I actually had, and another thought hit me: if the new server’s IP got exposed again, I would just end up wasting another IP address. So I gave up on that idea.
After that, my approach became pretty passive. If the attacker started again, I would simply shut the server down and wait for the blackhole period to end, then restart it. Otherwise, people exchanging links with me might think I had disappeared and remove my site from their blogrolls.
And while I was checking those links during some downtime, I discovered that a few bloggers had in fact already removed mine. The timing was probably just bad — my server happened to be in a blackhole period when they checked, which is honestly kind of funny in a miserable way.
To avoid losing even more links, I finally bought a Hong Kong host on the third night, hid the origin IP with Cloudflare, and put up a simple maintenance HTML page to show that I had not vanished.
At first I thought maybe someone was just practicing on my site and would stop after a day or two. Later I realized that was not the case. This was deliberate.
That was probably the hardest part to accept. It made me realize that someone really did hate me, even though I have never knowingly harmed anyone’s interests.
The DDoS attacks lasted four straight days and only stopped on the fifth. Maybe the attacker is even reading this now. I still do not know who you are, but there was no need for this. If I really did affect your interests somehow, was there truly no way to talk things over?
For a small, non-profit independent site owner like me, dealing with this kind of thing is genuinely painful. Sometimes I wonder why I keep doing this at all when it is this exhausting. And yet, somehow, I am still here.