Hi folks,
I see on the network outages forum that there is a large DDOS attack going on on Web 17 but please help me out with some updates. I have multiple accounts/domains on that server that have been down for nearly 6 hours now and have some angry customers looking for answers.
Please help!
Is this attack affecting web16, too? I have a site there that has been mostly down for the last 6-7 hours.
I’ve had MSSQL connectivety complaints too today. (MSSQL13) - I’ve had to change the external access IP to the regular domain url (mssql13.asdasd.XXX) in order to have it connect from an external source too.
It appears as if web17 has been fixed however I have several sites on web16 that I cannot access. I don’t know if it is related or not to the web17 issues from yesterday but I have put in a ticket.
web17 is down again.
Has been down:
Dec 8: 1 hour
Dec 9: 8 hours (I stopped monitoring after 8 hours downtime…)
Dec 10: 3,5 hours now (and still counting)
Al downtime started around 4-6pm CET (Central European Time), this is around 10am-12pm EST.
Unbeatable DDoS attacks?
Seems to be down still - I think the problem might be spreading too.
All domains on CL1-Web10 were unreachable, and domains on CL1-Web16 that used MySQL10 were not loading.
Hopefully they get this under control, this is a bad time of year for websites to be going down!
Looks like the other servers are back (still a little slow, especially MySQL10) - I sure hope they get Web17 back up ASAP.
Also - I REALLY hope they post some follow-up and news here. We’ve experienced a LOT of down time over the last couple of days.
Not sure what the IP address switch entails (posted in Network Status forum)…but things are down again. That post says it was almost three hours ago.
Right now I see all of my web17 sites looking for .102 in the control panel, but pinging on .57.
Not sure if I should do anything about this ("[FONT=Verdana]Virtual Host IP does not match DNS A Record. Probably shared IP tag was changed.[/FONT][SIZE=4][FONT=Times New Roman] [/FONT][/SIZE][FONT=Verdana][SIZE=4][FONT=Times New Roman]Resolve this problem[/FONT][/SIZE] ") [/FONT]
or just “wait and see”!
dont click anything. If pointing on .57 that is a GOOD thing. Parallels migration tools made a mess. We are working to resolve it now
We can work to config change yours sites and get them up sooner.
If you can update with domains pointing to the .57 but not opening and we can check their configs!
Every time I refreshed by tabs more sites would load normally - now everything seems to be loading again - what a relief!
I posted a long rant on another forum and was thinking about bringing it over here - but I don’t really know that it’s necessary?
I’d really like to hear more about JodoHost plans for the future. I think the discussion over new plans or new services has been brought up - but has there been any progress?
Bring up anything you’d like here, it is accepted and welcomed. We don’t hide things when there are trouble, and I’ve always answered questions, others as well.
AS for plans, nothing is set yet, working on some evaluations of DDOS solutions, and for other reseller hosting options it is something we’ve looked at but the market is small and product we were looking had a very large commitment that we could not make at the time. They’ve changed up some of their plans since then and we may talk to them again now, but some DDOS mitigation solutions are on tap to be priority first right now.
That’s one of the things I appreciate about JodoHost!
I understand about the reseller options - sometimes it’s just not possible to find the “perfect” balance or solution.
Thanks for the update, and I look forward to hearing about future plans as well!
Most of my sites seem ok, But have one that is on Web16. The main site is simple php, and is ok, but part of the domain (a ticket system) uses mysql8 heavily… and that had been intermittent for the past few days, and now completely down. Trying to access any part of that all day has returned simply:
[SIZE=4][FONT=Times New Roman]Fatal Error:[/FONT][/SIZE][SIZE=4][FONT=Times New Roman] Contact system adminstrator.[/FONT][/SIZE]
[SIZE=4][FONT=Times New Roman]Have submitted a ticket, no response. [/FONT][/SIZE][FONT=arial][RS #BHW-49518[/FONT][FONT=arial]-504][/FONT]
[SIZE=3][FONT=Times New Roman]Any thoughts?[/FONT][/SIZE]
And by the way, the ticket php software is trying to address mysql8 directly by ip address (173.0.129.24)
We have fixed the issue and website is up now. We have also replied your ticket. Please check the same.
Not only is my client’s entire web site gone but logins for two totally different domains are there now. Neither of which I take care of. Anyone else having these issues? Web17 seems to always be the problem child.
I had a site hacked last night (early this morning).
The hackers took down the main page, deleted the template (CMS) and also added several new domains to the account - garbage stuff like itkspalt.com
I’ve cleaned up the mess and changed the passwords. The old password was not obvious, but could have been guessed. The new ones are random and crazy, so hopefully that will solve that!
I’m not sure if this is similar to your issue - but I thought I’d throw it out there!
No, the sites (2 so far) are still there according to ftp but the IP is crossed up. Both sites now point to evodar.com and internetsalesoffice.com. One site just would not perform well running WordPress on a Windows server so I moved it. It was running good on W17 but is now gone. The other site was a fairly new account whi8ch was done last week because of some issues with WEB17 and now it too is gone because of some IP change which no one here made. most likely I will either lose these two accounts or will have to fork over some refund dollars to get them to stay.
There is an issue we heard of with this but thought got fixed. I would direct techs here to see it but it has the incorrect domains that are pointing from what I am reading here..
do you have a ticket in regard to this?
What happened is the Hsphere ip migration tool royally messed up some Apache config files for domains making them reference the wrong paths!! We thought we found them manually but obviously missed some.
We need the domains so we can fix the paths.
I’d recommend sending with a CC to [email protected] which is the proper escalation path, faster and better than the ticket desk and when used I am aware of the issues, as well as shift and company management. I do learn of them here on forums but its slower than helpline as helpline comes to the email inboxes.
I did mention this was one issue we found the tool did here in the status post:
Web17 - Large Botnet attacking multiple domains - DDOS - Network Outages and Updates - JodoHost Web Hosting Community
many apologies for this as soon as we know what domains incorrect we’ll get it sorted!
my client’s website’s files were all gone too on web17 
ticket: RS #FZA-30373-328
they were all there until the last DDOS.
it has 9 domains inside it and ALL GONE! manoj restored it from a week old backup.
PLEASE … PLEASE check the security of this server 