Hosting (host006) under DDOS attack

[Benjamin Dyer]

I was told ITV and big online games like World of warcraft are hosted on Actinic so I would be safe from problems. Both of those seem to be online?

The attack is just on a single server, other servers are not impacted.

[Rubberdave]

This is probably the busiest weekend for online sales, what is being done to move us onto another server, I am sure like many other users, we cannot wait for an attack to cease, posative action to resolve the situation is urgently required if we are not to loose valuable turnover.

[stuartjrobinson]

Hi Ben,

Sorry to be the one to ask difficult questions but as our livelihoods depend on our websites and hence on your service, I think it is only right to ask.

We are hoping the attack will be over soon

What if the attack doesn't subside?
Is there a "plan B"?
If so, what is it and when will this be implemented?

the support desk is closed until Tuesday

As CEO of Actinic would it not be conceivable to "open" the support desk? If the worst case scenario is that the attack does not subside, are we to wait until Tuesday before action is taken to move our sites to another server? And once the websites are moved, is there then a waiting time before they are "usable"? (propagation?)

Bearing in mind that a lot of companies rely on "January Sales", is it not prudent to take all measures to counter the worst case scenario? Imagine how NEXT would react if they were unable to open for their "New Year Sale"!

I appreciate that this is New Years Eve, a time when most will be celebrating, but with my financial security "uncertain" I'll find it easier to enjoy with a clearer understanding of this unfortunate situation.

[Mike Hughes]

Hi Stuart,

I can't help solve this particular problem but one option worth considering is to set up some new hosting with another host. You can then point the dns at the new host and be back online in less than an hour or so.

I don't know who controls the dns for your domain but it's not uncommon to keep this separate from your hosting. i.e. if you use someone like 123 reg then it's an easy job to switch hosts as and when needed.

Mike

ps. the process is fairly simple:

1. setup the dns to point at the the new hosts nameservers.
2. wait for the dns to propogate around the webs dns servers. Typically happens very quickly these days.
3. refresh your website once the dns has propogated and you're back online.

You may get some orders on both servers via this appraoch but these can all be brought into actinic later once the problems are sorted.

[stuartjrobinson]

Thanks Mike,

I was just looking into this as an option but I wasn't sure how long it might take.
Your explanation of the process has given me the confidence to take the next step.

[swardell]

Stuart if you are happy to change your DNS I can give you an alternate IP address on the same hosting server which should get you back on your feet. As the 'other' IP address is now blocked at the network core this new one should get you operational again. I do not, for obvious reasons, make the address public.

The attack is showing no signs of abating at this time

[stuartjrobinson]

Hi Stephen,

I've just been on the Plesk Control Panel and noticed that the IP address has changed. I presume I change the upload settings in Actinic to the new IP address and also change the DNS settings to the new IP address with my DNS registrar?

[Fridat]

Is it simply a question of changing the Server host FTP address (I am running Business online catalogue) in the advanced network setup and then uploading the online store?

If this is the case could I please have and alternative IP address?

Frida Turner

[swardell]

@Stuart, yes that's correct, where you have the old IP in you DNS, use the new one I have flipped your domain to in Plesk

[cbarling]

Please email me at cbarling at actinic.co.uk for instructions on how to recover from this attack.

If you bought your domain name from Actinic, please let me know.

Either way, please include your domain name in the email.

Chris

[swardell]

@Frida no, it is your DNS that needs to be re pointed to the alternate IP address, doing so will mean that you do not need to upload your site, it will be as it was prior to the attack. If you let me know your domain I will change it in Plesk and you can then update your DNS, if you bought your domain from Actinic then I will update your DNS

[swardell]

@Stuart I can see you have changed your DNS already and I can see your sitre backonline

one down...

[stuartjrobinson]

Hi Steve,

I'm sure I must have got it right - But I can't see the website myself yet!
I thought deleting browsing history and refreshing would cure it. Maybe I'll just have to give it an hour or two.

Thanks for your help.

[Benjamin Dyer]

As CEO of Actinic would it not be conceivable to "open" the support desk? If the worst case scenario is that the attack does not subside, are we to wait until Tuesday before action is taken to move our sites to another server? And once the websites are moved, is there then a waiting time before they are "usable"? (propagation?)

Indeed, we will have very limited support operating tomorrow for anyone that wants assistance migrating their DNS. Hopefully the attack will be over by then anyway.

More details to follow.

Ben

[swardell]

@Stuart DNS gets cached locally as well as by your ISP and potentially elsewhere in the chain from you to the server, so even a fast change can still take a while to become visible. I can browse around your site ok, so its up and running and I suspect it will be for you shortly too