DDOS Attack - any advice

[LHorton]

We are currently suffering a DDOS attack and have had to take our website down. I have reported the attach to the police but in the meantime, online orders have ground to a halt!

Has anyone on the forum experienced a DDOS attack? what is the best way forward?

Any advice please?

Lee

[Duncan Rounding]

I suggest you contact your host who may be able to take measures against the source of the attack.

Whay have you had to take your website down, were you getting invalid orders?

[pmsupport]

Hi Lee,

We spoke earlier today about this DDOS attack.

Unfortunately this is a DDOS attack on your domain name, and not a specific IP address, therefore the problem cannot be solved by changing your IP address (which is a common solution).

DDOS attacks are criminal activity, and the attacker can start the attack on your website at a very low cost.

One solution would be buying DDOS mitigation. An example DDOS mitigation supplier is http://www.redspam.com/. This is not a recommendation, just an example supplier. DDOS mitigation can be very expensive, however I will allow you to review the costs with them directly.

Our best advise would be to contact the police and continue to get updates from them, in the mean time, consider setting up your site on a new domain name. You could try changing your website address within Google Webmaster tools, if you feel the attack is not going to end any time soon.

I hope you find this useful.

Thanks

Paul

[LHorton]

Hi, thanks for you advice Duncan and Paul

I tried pointing my domain back at my original server but it went down again after about ten minutes!

So i guess the DDOS attack is still ongoing.

I have now moved our site to a new domain and everything seems to be running ok - just have the problem of letting our customers know how to find us now!

I am hoping this is only a temporary situation as we currently number one on Google for our main key words. I am somewhat concerned as to what the now domain will do to that.

Does anyone know how I can find out if the attack is still ongoing? Preferably without pointing the domain at my server and waiting for it to go down again?

Thanks
Lee

[Mike Hughes]

I've seen some good things said about awknet. They're pretty cheap and seem to start at about for $200/month for a DDOS protected proxy that will intercept and block the attack.

Best have a good read around and then talk to some DDOS mitigation suppliers. There's little else you can do, except hope they go away and that's not a particularly strong basis for a business decision.

Mike

[Artisan]

You could ask your host to block the attacker's IP if they're just using a single one. A lot of hosts will do this as a matter of course.

[LHorton]

Thanks Mike, Artisan

I have been doing some reading but still not sure what to do for the best. I have just tried pointing the domain back at my VS and again, it went down within 10 minutes!

Looking at the log file, there are about 50 different IP addresses accessing the site every 15 seconds. On the day the site first went down there was a 150 times increase in visits.

I am continuing with the new domain name for now and am looking in to limiting SEO damage.

Thanks again for your help and suggestions

Lee.