Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


SecureDragon down?
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

SecureDragon down?

marrcomarrco Member
edited May 2012 in General

All my VPS down atm, can't login to solusvm cp nor access my client area.

Thanked by 1Woet
«1

Comments

  • ElliotJElliotJ Member

    I can get to the SecureDragon website, just about.
    Justping is reporting high packet loss, so I'd presume they're under attack.

    Hold tight, hopefully @kujoe will be able to update you soonish.

  • huluwahuluwa Member

    It seems DDOSed

  • marrcomarrco Member

    mtr to sd reports packet loss well over 50%, so i guess it's just a ddos.

  • I can open SecureDragon, but soo... slow.....
    SolusVM is also down sometimes :(

  • Hm.. What is "crook" ?

  • InfinityInfinity Member, Host Rep
    edited May 2012

    @LAKid KuJoe may be a crook in your bigoted opinion but the rest of us know Joe is a great guy an has a great company. I don't see how being hit by a DDoS makes you bad, it's not like he chose to be hit.

    I'm sure he will step in soon and get this sorted.

  • yomeroyomero Member

    Mine is working fine again :O

  • raindog308raindog308 Administrator, Veteran
    edited May 2012

    Pinging from a VPS in Dallas, TX to my ultra-LEB at SD:

    64 bytes from x.x.x.x: icmp_seq=1 ttl=50 time=56.3 ms
    64 bytes from x.x.x.x: icmp_seq=2 ttl=50 time=56.2 ms
    64 bytes from x.x.x.x: icmp_seq=3 ttl=50 time=56.3 ms
    64 bytes from x.x.x.x: icmp_seq=4 ttl=50 time=56.3 ms
    64 bytes from x.x.x.x: icmp_seq=5 ttl=50 time=56.3 ms
    
    --- ping statistics ---
    5 packets transmitted, 5 received, 0% packet loss, time 4679ms
    rtt min/avg/max/mdev = 56.275/56.324/56.373/0.153 ms
    

    Looks fine to me.

    No problems using the client area, either.

    Hey, I could buy another ultra-LEB while I'm here...

  • LAKidLAKid Member

    @Infinity How do you know he's DDosed? Don't presume it is.

  • jcalebjcaleb Member

    It's just slow for under an hour. But everything normal now.

    I think it's just network, I can log in to vps earlier, but just very slow. 5 seconds per letter your type. but everything is ok, disk io, swap, and cpu.

    i think just ddos perhaps. why do people do this thing ddos. what do they get with it?

  • jcalebjcaleb Member

    @LAKid

    secure dragon is great. it's just minor hiccup, things happen you now. anyways, he updated customers here: https://my.securedragon.net/announcements.php?id=159

  • yomeroyomero Member

    Tonight at 9:40 AM
    xD

  • jcalebjcaleb Member

    @Yomero it is evening here in Manila when it happened, so tonight is correct for me =)

  • yomeroyomero Member

    @jcaleb
    LOL! Ok ok :P

  • InfinityInfinity Member, Host Rep

    @LAKid said: @Infinity How do you know he's DDosed? Don't presume it is.

    I can presume whatever I want, it could be anything, from network issues to a DDoS. I got my point across, that's all I care.

  • KuJoeKuJoe Member, Host Rep
    edited May 2012

    Sorry for the lack of communication. I was at the beach when I got the alerts so I was walking Steve through the troubleshooting and fix. It appears a client was getting DOSed at 152k PPS which didn't bring anything down but caused some packet loss. We were able to resolve the problem without having to nullroute the client luckily because it was being generated from a single server (although it kept changing source IPs it was slow enough for us to manually take care of them).

    Funny enough, we have an automated system in place to handle this but there is a problem on the DC side of things that we are waiting to hear back from Cisco before we can implement it.

    Based on our monitoring, the degradation started at around 9:40AM and lasted until about 10:40AM (that's when the last "ONLINE" alert e-mail was generated).

    I did notice the typo on the announcement that went out (Steve was doing a bunch of stuff at the time so the announcement was thrown together while he was trying to troubleshoot and fix the problem, I'm sure we can all agree that the announcement was 2nd to getting everything back to normal). I did fix the announcement and will update it as an RFO instead.

    Thanked by 1gsrdgrdghd
  • So, I just wake up this morning, 5.00 AM.

    And I have an email from SecureDragon, saying that I'm under DDOS with 152k PPS.
    Did someone loves me so much? :(, before this, I'm receiving 31931pps, now 152k pps

    My two blogs were atacked :(

    1st, my personal blog/homepage, when I'm with Hostigation and then Transferring to BuyVM with filtered IP, so it's stoped.

    2nd, my another website, which hosted in SecureDragon.

    Should I remove any backlinks from both of my site?

  • FranciscoFrancisco Top Host, Host Rep, Veteran

    @DotVPS said: Oh my BuyVM

    He has a filtered IP, we're feeling nothing and i've heard no complaints of him having issues on his setup :P

    <3 Aegis

    @Kujoe - Please yell at your datacenter.

    Francisco

  • yomeroyomero Member

    Ponaegis

    Nice, 150k.
    Sometimes I get nullrouted from BuyVM by... 20k or sth xD

  • FranciscoFrancisco Top Host, Host Rep, Veteran

    @yomero said: Sometimes I get nullrouted from BuyVM by... 20k or sth xD

    Yep, we don't tank huge floods on the unprotected network, there's no reason to :P If you're bringing the heat for that much pps then you can pay for it.

    Francisco

  • camargcamarg Member

    packets per second???

  • Let's imagine if we could implement DDOS in the real life :
    If 152.000 pps = 152.000 packets per second

    If we need to carry many box with 100kg of each, but we can carry it 152.000 box / seconds. Wouldn't it just be great? :D

  • yomeroyomero Member

    @Francisco said: If you're bringing the heat for that much pps then you can pay for it.

    Wasn't a complain n_n
    You know, is the stupid quake stuff. Still is ongoing ¬¬ And of course I can't stop the incoming traffic.

  • FranciscoFrancisco Top Host, Host Rep, Veteran

    @yomero said: You know, is the stupid quake stuff. Still is ongoing ¬¬ And of course I can't stop the incoming traffic.

    I wonder if awknet could filter it since the packet is always the same? Can't you use the strings plug to iptables to detect and just drop it?

    Francisco

  • yomeroyomero Member

    Yes, isn't the problem. But still it gets inbound.
    Also, some packets are legit :P
    The fix for the outbound is done, but you can't do nothing about inbound UDP. Generally isn't an issue (<10KB/s), but sometimes I get punished for burst periods lol.

  • FranciscoFrancisco Top Host, Host Rep, Veteran

    @yomero said: but sometimes I get punished for burst periods lol.

    Ah those bastards, always with the reflection floods :P

    Francisco

  • yomeroyomero Member

    @Francisco said: Ah those bastards, always with the reflection floods :P

    YEs, hopefully will stop soon. Is eating my traffic ¬¬

  • KuJoeKuJoe Member, Host Rep

    A correction to my previous post. The attack actually peaked at 254k pps (our monitoring recorded 152k pps but Steve was able to screenshot it at 254k pps before resolving it).

    Looks like we're getting a 150k pps flood now against a different target. Happy Cinco De Mayo! :)

  • yomeroyomero Member

    @KuJoe said: Happy Cinco De Mayo! :)

    This xD

  • KuJoeKuJoe Member, Host Rep

    It looks like the attacks are all generating from the same datacenter in Singapore against random IPs on our network. Guess they hate dragons. LoL.

Sign In or Register to comment.