Early on Thursday last week (PST) our websites encountered an attack, one which is often referred to as a “DDOS” (distributed denial-of-service) attack.

While our network is setup to handle very substantial traffic (it deals with over 50 million visitors each month), as has been seen by other large Internet sites (Twitter, Facebook, Google et. al.) such a large scale attack will cause connection difficulties. In this we were no different, and it wasn't until sometime on the weekend where we were able to implement a successful resolution to the issue.

As part of the implementation of the resolution you may have encountered some issues with the site and its functionality, we are working through each of those items, and if you come across an issue, if you could please post it in here to ensure that we have seen it, it would be appreciated.

We have been (and continue to) work around the clock until all the issues are resolved, our apologizes for the inconvenience.
Thanks,
Adrian – Internet Brands

 

I am just informing you that I have been Having this issue since yesterday, I haven't had any problems with any other site. Here is what I'm seeing from around yesterday at noon to present.

 

We have still been "under attack", we are trying to minimize outages.

 

ok, just letting you know

 

Still having issues. It sometimes will load a page ok but more often than not, it takes several reloads to get it done, if at all.

 

 

Thanks for letting me know.

 

I just got the same Database Error page while attempting a search.

 

Still slow a few minutes ago. It would just load and load forever then time out.

 

Sorry - we fixed the db error when searching just after it being reported.
The other issues should have been resolved too.

Again, sorry!

 

Don't know if the DDOS is still "on" or not, but things seem pretty-much back to "normal" as of this writing.

Thanks for all you guys do to keep the site up and running smoothly. I realize what it COULD be like!

Pop

 

Thanks for letting us know Pop.
We are still experiencing a lot of "malicious" traffic, but have invested a great deal in hardware that can manage it appropriately so we can keep the site a'runnin!

 

Took 10 mins just to be able to post this meessage. Seems like sometimes it is ok and other times you wait and wait or you keep trying to reload the page.

 

Since you upgraded your server software I have had many port scans and intrusion attemtps from your IP addy. In fact while I was writing you wre blocked because of this.
TCP RESET SCAN 2009-12-17 16:11:55 source IP 67.201.17.125, destination IP 68.97.26.xxx, port 62964

TCP RESET SCAN 2009-12-17 16:11:55 source IP 67.201.17.125, destination IP 68.97.26.xxx, port 62963

TCP RESET SCAN 2009-12-17 16:11:55 source IP 67.201.17.125, destination IP 68.97.26.xxx, port 62965

TCP RESET SCAN 2009-12-17 16:11:55 source IP 67.201.17.125, destination IP 68.97.26.xxx, port 62955

TCP RESET SCAN 2009-12-17 16:11:55 source IP 67.201.17.125, destination IP 68.97.26.xxx, port 62954

TCP RESET SCAN 2009-12-17 16:11:55 source IP 67.201.17.125, destination IP 68.97.26.xxx, port 62956

TCP RESET SCAN 2009-12-17 16:11:55 source IP 67.201.17.125, destination IP 68.97.26.xxx, port 62953

TCP RESET SCAN 2009-12-17 16:11:55 source IP 67.201.17.125, destination IP 68.97.26.xxx, port 62906

TCP RESET SCAN 2009-12-21 18:48:34 source IP 67.201.17.125, destination IP 68.97.26.xxx, port 51947

TCP RESET SCAN 2009-12-21 18:48:34 source IP 67.201.17.125, destination IP 68.97.26.xxx, port 51926

TCP RESET SCAN 2009-12-21 18:48:34 source IP 67.201.17.125, destination IP 68.97.26.xxx, port 51923

TCP RESET SCAN 2009-12-21 18:48:34 source IP 67.201.17.125, destination IP 68.97.26.xxx, port 51927

TCP RESET SCAN 2009-12-21 18:48:34 source IP 67.201.17.125, destination IP 68.97.26.xxx, port 51924

TCP RESET SCAN 2009-12-21 18:48:34 source IP 67.201.17.125, destination IP 68.97.26.xxx, port 51942

TCP RESET SCAN 2009-12-21 18:48:34 source IP 67.201.17.125, destination IP 68.97.26.xxx, port 51943

TCP RESET SCAN 2009-12-21 18:48:34 source IP 67.201.17.125, destination IP 68.97.26.xxx, port 51928
BLACKLIST

IP Address Timestamp

67.201.17.125 2009-12-21 18:55:49
Initiator IP Address Initiator Port Responder IP Address Responder Port Transport Protocol Time Blocking Reason

67.201.17.125 80 68.97.26.xxx 52098 TCP 2009-12-21 18:49:44 INTRUSION BLACK LIST DEFENSE

67.201.17.125 80 68.97.26.xxx 52099 TCP 2009-12-21 18:49:44 INTRUSION BLACK LIST DEFENSE

67.201.17.125 80 68.97.26.xxx 52102 TCP 2009-12-21 18:49:44 INTRUSION BLACK LIST DEFENSE

67.201.17.125 80 68.97.26.xxx 52141 TCP 2009-12-21 18:50:35 INTRUSION BLACK LIST DEFENSE

67.201.17.125 80 68.97.26.xxx 52145 TCP 2009-12-21 18:50:42 INTRUSION BLACK LIST DEFENSE

67.201.17.125 80 68.97.26.xxx 52146 TCP 2009-12-21 18:50:42 INTRUSION BLACK LIST DEFENSE

 

Since you are not a supporter, you see ads.

Could this be from IB's ad server?

Pop