electra DDoS (was - "Domains downtime problem")

[Edmond.B]

Hi

I have a reseller plan on HG. So far i am very happy with the service and support provided but this weekend a problem appeared where none of the domains i host (including mine) is opening. It opens for a short while then goes down for 10-15 min.

I'd like to know if there's some problems at you or what. First i thought it was the ISP in my country but after contacting them they confirmed that everything is ok at them.

Some friend helped me to check and we confirmed that every other site is opening except for the ones i have that are hoste by HG.

www.kosovagamers.com is the domain that i need most at this time since we have a tournament going on and people need to get informed.

There is a possibility that someone is attacking that site but how come the others don't work?

i have www.pclajme.com & www.prishtinahost.com (blank page, no index but it still not opening)

Cheers

[GatorFord]

Thanks for bringing this to my attention. There was a fairly crude apache attack on the server causing slowness. I'm mitigating the attack now.

[Edmond.B]

I thought so. Seems like they are still attacking since the webs aren't working.

=(

[GvilleRick]

All three domains are loading for me.

[GatorFord]

Originally Posted by Edmond.B

I thought so. Seems like they are still attacking since the webs aren't working.

=(

Yes they are still *trying* to hit the box with a pretty large botnet with a huge amount of random B blocks. I'm continuing blocking all the malicious traffic and the domains are loading near instantly for me at this time. If you end up being inadvertently null routed (i.e. you can't even ping the box then we may have blocked you if you were hitting the machine repeatedly. If so, just call in or submit a ticket and we can get you unblocked.)

[Edmond.B]

Thing is that the 2 major ISP in my country use some kind of public IP which means that a whole city can have only 1 public ip. Perhaps my ip was blocked too.

My ip atm is 82.114.84.74

[Edmond.B]

Could you possible email me the ip of the attacker please?

[Sam]

Originally Posted by Edmond.B

Could you possible email me the ip of the attacker please?

As Ford said, It's a botnet attacking the server. There wont be one IP, there will be thousands.

[GatorFord]

Originally Posted by Edmond.B

Thing is that the 2 major ISP in my country use some kind of public IP which means that a whole city can have only 1 public ip. Perhaps my ip was blocked too.

My ip atm is 82.114.84.74

Your IP is not blocked :

[root@electra ~]# route -n | grep 82.114.84.74
[root@electra ~]#

I'm still actively blocking them but they're doing hardly anything to the server at this time due to the changes that we've made to mitigate this. They will eventually get bored, realize they are wasting their resources, and move on.

[Edmond.B]

I don't know what kind of system my ISP uses but everytime i connect to the net i have a different IP.

From home i can access my websites but from work (where i spent most of the day) i can't. Same ISP!!!

Me and many others with the same ISP have a problem with opening the website. Sometimes it's too slow, sometimes it doesn't work at all.

I've called the ISP and they said that every PC/User gets a different IP but the whole city (500.000 people) has like 2-3 "public" IP's. And blocking one of those could result in the problem mentioned above.

HG has been great with the support and lots of users with the other ISP don't have a problem at all.

The support i got from HG was incredibly great and professional.

The only problem could be that the attacker uses the same ISP and he was the reason that the "public" IP got blocked.

I had a CounterStrike online server and closed it for the same problem. If you would ban 1 IP, you banned a whole part of the city.

Please advice me what to do. I am the admin of that website and i need to... well you know, do admin stuff.

Please open a support ticket with your work IP (visit this page to get your IP), and we'll verify no filtering is taking place for that address. Thanks.

[Edmond.B]

80.80.161.138
80.80.170.114


Everytime i restart the modem i get a different ip so that wouldn't solve anything.

[jakeruston]

Have they stopped the attack yet?

I hope you get it sorted.

[Edmond.B]

Yeah its ok now as it seems. Alot of IP's were blocked though with that "inserted insult here" system our ISP uses.

HG technics were amazing and helped 24/7.

HG!

[rabeles]

Originally Posted by Edmond.B

I don't know what kind of system my ISP uses but everytime i connect to the net i have a different IP.

From home i can access my websites but from work (where i spent most of the day) i can't. Same ISP!!!

Me and many others with the same ISP have a problem with opening the website. Sometimes it's too slow, sometimes it doesn't work at all.

I've called the ISP and they said that every PC/User gets a different IP but the whole city (500.000 people) has like 2-3 "public" IP's. And blocking one of those could result in the problem mentioned above.

Your ISP cramming that many inside IP addrs onto that few outside IP addrs could have consequences. Fragmented packets might not be getting through intact due to connection loss in their NAT. Try pinging from your problem connection to your host IP w/packets larger than MTU size.

[Edmond.B]

Everything is ok now.




Thanks HG!

Thanks; closing this thread.