DDOS attack 7&8 March 2008

[MrI4N]

Why was there a DDOS attack on the Dream-Host servers 7 & 8 March?

I guess we are all Silver Packages as I know there are number of sites hosted on the same server but, they all look like low level commercial or hobby sites to me.

Was the target Dream-Hosting its self?

IanR

[Sirnag]

still down here too.. thats 3 days and no email available either. whats going on?.

[Azurael]

I must say this has been a terrible inconvenience which I don't think was handled too well by the Dream Hosting guys.

You need to change your nameservers as follows if your domain isn't registered with DH themselves:

ns1.enixns.com (64.91.230.240)

ns2.enixns.com (209.59.140.101)

ns3.enixns.com (69.16.196.38)

ns4.enixns.com (72.52.144.131)

They didn't bother sending me an email telling me this to my alternative address I registered with them and left it to customers to work out themselves after their sites stopped working, which left me without email for a whole morning. Thanks.

Edit: Actually, HTTP and POP3 are both down on my server at the moment anyway, so I can't even access it by IP. The DNS is still resolving fine with whatever I already had set as my nameserver. The FTP server's up though....

Edit 2: HTTP is back up. Still getting connection refused on the mailserver though.

Edit 3: It's down again. Like a yo-yo today. I think I'm going to have to take my business elsewhere.

[MrI4N]

Here are a couple of tracert to my web site. You can see there is a big delay getting from London to New York (hops 8 to 9) and something else going on in Chicago where there is a 1/2 second delay! (hops 14, 15 and 16). This has been the pattern since this all started. The ping used to be about 135mS so its not right. Having said that its been getting better as I'm looking at it!

5 15 ms 15 ms 16 ms so-1-0-0.mpr1.lhr2.uk.above.net [64.125.28.38]
6 16 ms 16 ms 16 ms abv-l3-pni.London1.Level3.net [208.185.188.186]
7 16 ms 16 ms 17 ms ae-32-52.ebr2.London1.Level3.net [4.68.116.62]
8 88 ms 90 ms 90 ms ae-4.ebr1.NewYork1.Level3.net [4.69.132.109]
9 93 ms 90 ms 90 ms ae-71-71.csw2.NewYork1.Level3.net [4.69.134.70]
10 88 ms 87 ms 89 ms ae-72-72.ebr2.NewYork1.Level3.net [4.69.134.85]
11 110 ms 108 ms 107 ms ae-2.ebr1.Chicago1.Level3.net [4.69.132.65]
12 108 ms 108 ms 108 ms ae-11-51.car1.Chicago1.Level3.net [4.68.101.2]
13 116 ms 117 ms 116 ms WBS-CONNECT.edge5.Chicago1.Level3.net [4.71.182.14]
14 122 ms 126 ms 121 ms lw-core2-ge3.rtr.liquidweb.com [209.59.157.38]
15 122 ms 153 ms 518 ms lw-dc1-dist1-ge2.rtr.liquidweb.com [209.59.157.14]
16 195 ms 186 ms 188 ms host.drht.net [64.91.230.245]


5 16 ms 19 ms 16 ms so-1-0-0.mpr1.lhr2.uk.above.net [64.125.28.38]
6 16 ms 16 ms 16 ms abv-l3-pni.London1.Level3.net [208.185.188.186]
7 26 ms 17 ms 17 ms ae-32-52.ebr2.London1.Level3.net [4.68.116.62]
8 86 ms 88 ms 89 ms ae-4.ebr1.NewYork1.Level3.net [4.69.132.109]
9 86 ms 87 ms 90 ms ae-71-71.csw2.NewYork1.Level3.net [4.69.134.70]
10 95 ms 90 ms 90 ms ae-72-72.ebr2.NewYork1.Level3.net [4.69.134.85]
11 107 ms 107 ms 107 ms ae-2.ebr1.Chicago1.Level3.net [4.69.132.65]
12 108 ms 108 ms 107 ms ae-11-51.car1.Chicago1.Level3.net [4.68.101.2]
13 116 ms 117 ms 117 ms WBS-CONNECT.edge5.Chicago1.Level3.net [4.71.182.14]
14 140 ms 141 ms 140 ms lw-core2-ge3.rtr.liquidweb.com [209.59.157.38]
15 467 ms 142 ms 150 ms lw-dc1-dist1-ge2.rtr.liquidweb.com [209.59.157.14]
16 253 ms 252 ms 236 ms host.drht.net [64.91.230.245]


The thing I don't understand is that I always thought that a DDOS attack was focused to the IP address, so unless you change the IP address you are not going to clear the attack. If you change your IP address you have to update the DNS servers, but that is not what has happened here. I'm switched over to the new DNS servers but tracert still resolves to the old IP address!?

I have always rated DH's support teams as very quick and very helpful but this time we not being kept up to date. I don't want to raise a trouble ticket because I guess they are busy. But I want to know what is going on.

Is there a Forum Admin that can help here please?

IanR

[admin]

Hi,

Due to security reasons we will not discuss the details of the DDOS attack on a public forum but all those affected will be mailed with all the details of this event.

Any further questions we can be contacted at the support centre or info@dream-hosting.co.uk

Admin