lada.websitewelcome.com

***GatorFord*** · #1 07-17-2007, 04:56 PM

Our server lada.websitewelcome.com has been null-routed by our datacenter due to a a large inbound attack that is saturating their network.

I'm working with them at this time to get the null route removed when traffic subsides to manageable levels, but I don't yet have an ETA on when the attack rate will drop. We'll keep you posted.

***GatorBrent*** · #2 07-17-2007, 05:01 PM

This is one of the largest attacks we have ever seen on a server. It is definitely the longest attack we've seen.

The dos is about 1.4 gigs in size and was at 1.8 a little earlier. It is so much traffic that the entire switch becomes overwhelmed causing all the servers on it to go offline.

It's attacking the servers main ip so unfortunately there is very little that can be done.

EP EP · #3 07-17-2007, 05:07 PM

Lada appears to be down again. Please update as soon as she's back online!

EP

kevrobin · #4 07-17-2007, 09:49 PM

This happened yesterday starting around 4pm est and today at 2pm est. I wish they would go play somewhere else.....

EP EP · #5 07-18-2007, 12:15 AM

Looks like she's back online for the time being. Let's hope they've moved on.

EP

***GatorDaveC*** · #6 07-19-2007, 12:09 PM

It looks like Lada is getting DDoS attacked again. We have setup dual Vhosts on all of the current Domains hosted on the main IP of the server which will keep your sites online during the attack. DNS resolution will be a little bit slower during this time since the main IP hosts one of the Name servers.

We are sorry about the issues lately on this server, it's very hard to track down this kind of attack since it's not attacking a specific domain. The IP it self is being attacked with over 1Gbit of traffic.

***GatorDaveC*** · #7 07-21-2007, 06:30 AM

I have manged to track down exactly which domain the attack was doming from. The client will be permanently banned from the server due to this. We were able to track down the attack by a couple of DNS queries made before the attack using rndc query logging, and using our custom iptables settings which have exact packet matching.

All of the sites should have been online during the recent attacks due to the round robin DNS we setup for all of your accounts.

Sorry about all the trouble this week.