Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


BMail.ag - Secure Email Service
Server.net
CPLicense.net
VPS Server
Buy VPN
Vultr
VMs for AI
HostDare
ReliableSite White-Label Dedicated Hosting for Resellers
25% Recurring Discount on NVMe VPS
Try EnsoVPN - Reliable VPN - 1-Day Free Trial
InterServer VPS
BMail.ag - Secure Email Service
Best VPN
High-Performance Bare Metal Server Solutions
Karvl.com
Server Mania Cloud Hosting
DataWagon Hosting
AlphaVPS Hosting
Evoxt.com
Clouvider
VPS Hosting with NVMe
Residential IPs in the US & 4G Mobile Proxies in EU & US with Unlimited Bandwidth
ReliableSite White-Label Dedicated Hosting for Resellers
Rabisu - Hosting Solutions
CloudLinux
Try EnsoVPN - Fast & Private VPN - 1-Day Free Trial
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

DDoS Effecting AVS ISP

2

Comments

  • avsispavsisp Member, Patron Provider

    @zed said:
    i suspect canada

    Or those darn Yankees :wink:

  • x0x0xx0x0x Member

    @Alyx said:
    Probably better for the future to not make accusations if you are not sure about it.
    LET user doing LET things is one thing. A company doing an official statement is something else.

    This isn't the first time they're announcing they're being DDoSed. Any hosting provider would be aware that DDoS attacks can happen, but public announcements and following it up with geopolitical accusations seem unnecessary when all of this should have been communicated directly to affected customers only.

  • avsispavsisp Member, Patron Provider
    edited June 26

    @x0x0x said:

    @Alyx said:
    Probably better for the future to not make accusations if you are not sure about it.
    LET user doing LET things is one thing. A company doing an official statement is something else.

    This isn't the first time they're announcing they're being DDoSed. Any hosting provider would be aware that DDoS attacks can happen, but public announcements and following it up with geopolitical accusations seem unnecessary when all of this should have been communicated directly to affected customers only.

    Affected customers are all customers and the majority of our customers are from LET. There's a reason LET has the Outages section.

    We don't post any DDoS that happens, we get them often. We only post when it's severe enough it knocks off majority of clients.

    Also, our email systems and website even have been effected - it's hard to send an announcement to clients when systems are up and down.

    We are a very transparent host. We don't go hiding when we have these issues and wait for he flood of posts complaining and people calling us a scam and asking for refund. The few times we didn't post quick enough, someone else will email, call, and message everywhere calling us a scam. Better to be transparent and upfront with all clients - past, present, and future.

    Thanked by 1rpqu
  • AlyxAlyx Member, Host Rep

    As much as I disagree with the "lets blame state actors" thing.
    I do respect that you are communicating issues and posting updates.

    Definitly more than you can say about some other providers.

  • seoworldseoworld Member

    Oh, come on—there were outages all morning in Macedonia; did the cat walk across the cable? That just doesn't add up! Your expertise might be good, but for the international business—count me out!

  • wldtrvwldtrv Member

    It's definitely still on-going, Albania is out again this morning.

  • @seoworld said: did the cat walk across the cable?

    No! it was state sponsored of russian hackers. They cut the cable.
    I don't have proof. But I have so much evidence, cannot be a coincidence. ;)

  • avsispavsisp Member, Patron Provider

    @wldtrv said:
    It's definitely still on-going, Albania is out again this morning.

    Was rerouted again. Monitors detected 6Mpps hitting AL and MK this morning and flipped back to GSL routing.

    Thanked by 1forest
  • wldtrvwldtrv Member

    @avsisp said:

    @wldtrv said:
    It's definitely still on-going, Albania is out again this morning.

    Was rerouted again. Monitors detected 6Mpps hitting AL and MK this morning and flipped back to GSL routing.

    Working again, thank you for the update.

    Thanked by 2avsisp forest
  • angstromangstrom Moderator

    People, please stay on-topic. The topic is described in the opening post

  • edited June 27

    @avsisp said:

    @luckypenguin said:

    @avsisp said: a lot of our IPs were apparently added to the famous Russian drop lists - with traffic being blackholed by all Russian ISPs

    That's a sign that you host public VPN services focused on russian users. They detect multiple RU sources connecting to the same IP with large traffic volumes and block it.
    The government doesn't order anything, it's a semi-automated system like DPI.
    From that, to jump to a conclusion it was a state sponsored attack was a huge stretch :)
    They have a fuel crisis now, not exactly the perfect timing to DDoS a small Albanian ISP.

    Again, we said we suspect it to be. We gave the signs. The biggest isn't only that they blackholed it - but that they un-blackholed it long enough to start a full blown DDoS - which only the government can turn those blocks on and off at will. The majority of that source traffic came across links with high Russian ISPs - like links using GNM-IX for example.

    We've not given a definitive "IT'S THEM, THEY DID IT" - we gave the signs and our opinion on where we believe it originates along with a "we can't prove it, but we suspect" disclaimer.

    Even a (semi-serious) suspicion would need some kind of motive. What would make you so important to them that they'd burn resources they could otherwise direct elsewhere? As far as VPN activity is concerned: As @luckypenguin already said that's exactly what gets you blocklisted over there but this is nothing really personal or special.

    Unless you are hosting some kind of Ukrainian drone backend or whatever i don't see why the Russian government would even notice your existence let alone spend resources on you. No offense but in the grand scheme of things most of us just aren't much of a big deal. It's natural.

  • angstromangstrom Moderator

    I'm closing this thread for a couple of hours

  • angstromangstrom Moderator

    I've done a massive clean-up of this thread

    Thread reopened

    People, please stay on-topic

    @avsisp , it would be useful if you gave an update on the situation that you described in the opening post

    Thanked by 2tentor avsisp
  • avsispavsisp Member, Patron Provider

    @angstrom said:
    I've done a massive clean-up of this thread

    Thread reopened

    People, please stay on-topic

    @avsisp , it would be useful if you gave an update on the situation that you described in the opening post

    At this time the only updates we have are:
    1) Last night the DDoS ended from around 11pm until about 9am this morning (CEST) at which time it resumed
    2) We re-routed locally last night, however as the DDoS is ongoing again, we were forced to reroute again this morning to GSL for filtering.
    3) We are awaiting confirmation from GSL when the DDoS has ended for several hours before rerouting back.
    4) We've implemented automatic monitoring and rerouting to GSL is now automated should it start again after that.

    Also - thank you for taking the time to handle the cleanup of thread. Appreciate your efforts @Armstrong

    Thanked by 1angstrom
  • jsgjsg Member, Resident Benchmarker

    @avsisp said:
    We are a very transparent host. We don't go hiding when we have these issues and wait ...

    Kudos for that!

    Thanked by 3avsisp forest bbmmsvr4u
  • NekoparaNekopara Member

    is this happening again? albania seems to be down for almost 4 hours now. logging into the dashboard and trying to control my VM just returns "Proxmox cant find that vm"

  • forestforest Member

    @Nekopara said:
    is this happening again? albania seems to be down for almost 4 hours now. logging into the dashboard and trying to control my VM just returns "Proxmox cant find that vm"

    Same issue here (but in MK). I'm glad I'm not the only one because it means that others share my suffering my VPS hasn't just been destroyed without my notification.

  • @forest said:

    @Nekopara said:
    is this happening again? albania seems to be down for almost 4 hours now. logging into the dashboard and trying to control my VM just returns "Proxmox cant find that vm"

    Same issue here (but in MK). I'm glad I'm not the only one because it means that others share my suffering my VPS hasn't just been destroyed without my notification.

    I don't see such conclusion, the error points to more vm integrity being suspect than it being all ok.

    As in, their whole vm storage gets malware wiped.

  • forestforest Member

    @TimboJones said:

    @forest said:

    @Nekopara said:
    is this happening again? albania seems to be down for almost 4 hours now. logging into the dashboard and trying to control my VM just returns "Proxmox cant find that vm"

    Same issue here (but in MK). I'm glad I'm not the only one because it means that others share my suffering my VPS hasn't just been destroyed without my notification.

    I don't see such conclusion, the error points to more vm integrity being suspect than it being all ok.

    As in, their whole vm storage gets malware wiped.

    I suppose what I meant is that my VPS wasn't intentionally destroyed by AVS ISP (e.g. due to false abuse complaints or CPU/network overuse). I have backups and it'll be easy enough for me to restore the data even if the whole thing was wiped.

  • forestforest Member

    @Nekopara said:
    is this happening again? albania seems to be down for almost 4 hours now. logging into the dashboard and trying to control my VM just returns "Proxmox cant find that vm"

    In reply to my ticket:

    https://www.reutersconnect.com/item/powerful-storm-leaves-trail-of-damage-across-north-macedonias-capital/dGFnOnJldXRlcnMuY29tLDIwMjY6bmV3c21sX09XQU5BQ0FBVklERU8yMDI2MDcyMTQyMDMzMjkw

    A severe hurricane ran across the entire Balkans and caused damage, flooding, ripped cables, and lines from Sofia (in Bulgaria) all the way to Tirana in Albania. Teams are working in the field to sort through all the damage and debris to find the cables that are damaged and fix them. Power is now up - but cables are damaged that provider transit links and cross connections between datacenters and upstreams.

    Thanked by 1Nekopara
  • avsispavsisp Member, Patron Provider

    An update for anyone effected by the current outage:
    It is NOT DDoS related. All servers are safe and VMs are not deleted or destroyed. Power is up - but cables are damaged for connectivity.

    All across the region, there's been some very strange weather that has damaged Dark Fiber, L2 links, etc - There's teams in the field trying to cleanup the debris, sort through the damage, find the broken cables, and repair them. There's outages all across the region - from cellular providers to entire datacenters being offline.

    The latest update we got from the provider of our links is:
    "We've found some breaks and fixed them, but we still don't get line of sight through - there's more breaks along the routes - we're trying to find and fix them all as quickly as we can."

    Thanked by 3forest SKfSs93BPM Murv
  • avsispavsisp Member, Patron Provider
    edited July 22

    @TimboJones said:

    @forest said:

    @Nekopara said:
    is this happening again? albania seems to be down for almost 4 hours now. logging into the dashboard and trying to control my VM just returns "Proxmox cant find that vm"

    Same issue here (but in MK). I'm glad I'm not the only one because it means that others share my suffering my VPS hasn't just been destroyed without my notification.

    I don't see such conclusion, the error points to more vm integrity being suspect than it being all ok.

    As in, their whole vm storage gets malware wiped.

    Not exactly how that works. If the web server can't connect to the host node, it can't see the VM and can't control it or talk to it -> that error occurs.

    In this case, there's nothing wrong with any VMs - there's simply no connectivity to the backend nodes at all (host nodes) in Albania and MK due to cables being severed by storms (hurricanes) that ripped through the Balkans. No servers are down at all - power is up - VMs are safe. Only the panel can't talk to them right now until there's connectivity again.

  • forestforest Member

    @avsisp said: No servers are down at all - power is up - VMs are safe. Only the panel can't talk to them right now until there's connectivity again.

    Mine is down, but I'll have to wait until the panel is back up to figure out why!

  • avsispavsisp Member, Patron Provider
    edited July 22

    @forest said:

    @avsisp said: No servers are down at all - power is up - VMs are safe. Only the panel can't talk to them right now until there's connectivity again.

    Mine is down, but I'll have to wait until the panel is back up to figure out why!

    The VM itself is not down in the sense it is booted and running - the connections to it from the outside world are down.

    Once the connections come back, it should be instantly accessible.

    The panel error is misleading - as I've said. The problem isn't a missing VM. It's a missing host node due to no connection to it.

    Think of it like a home computer. You have it plugged in, it's on, but you unplug the internet cable - nothing on it is deleted or broken, but it can't be accessed from the outside world until that internet is plugged back in.

    Thanked by 1forest
  • forestforest Member

    @avsisp said: The VM itself is not down in the sense it is booted and running - the connections to it from the outside world are down.

    Poor thing must be lonely :cry:

    Thanked by 1avsisp
  • avsispavsisp Member, Patron Provider

    @forest said:

    @avsisp said: The VM itself is not down in the sense it is booted and running - the connections to it from the outside world are down.

    Poor thing must be lonely :cry:

    😢

    Thanked by 1forest
  • rpqurpqu Member

    Not DDoS, but Act of God

    Thanked by 3avsisp Nekopara forest
  • avsispavsisp Member, Patron Provider
    edited July 22

    @rpqu said:
    Not DDoS, but Act of God

    Literally - and quite sad to be honest. One electrician in Albania lost his life this morning trying to fix some of the damaged lines. And several others in MK also passed away from the storms and repair works. It's very very sad.

    https://albaniandailynews.com/news/oshee-worker-dies-during-overnight-power-line-repair-in-southern-albania

  • forestforest Member

    @avsisp said:

    @rpqu said:
    Not DDoS, but Act of God

    Literally - and quite sad to be honest. One electrician in Albania lost his life this morning trying to fix some of the damaged lines. And several others in MK also passed away from the storms and repair works. It's very very sad.

    https://albaniandailynews.com/news/oshee-worker-dies-during-overnight-power-line-repair-in-southern-albania

    I have huge respect for electricians and linemen especially. People underestimate both the voltages involved as well as the constant risk of climbing such heights.

  • avsispavsisp Member, Patron Provider

    Update from the guys in the field:
    [7/22, 14:20]: Latest update we wait for hevy machinery to allow access near neokom, the whole roof felt nead its not safe for teams to aproach.
    Eta 1h and this looks like the final part to make the cables work
    [7/22, 14:21]: Im more scared that wind is increasing again

Sign In or Register to comment.