Levelhosting.ca Is Down

Portal Home > Knowledgebase > Industry Announcements > Web Hosting Main Forums > Providers and Network Outages and Updates > Levelhosting.ca Is Down

Posted by IMTeam, 05-28-2012, 08:54 AM
My sites hosted in LevelHosting are down.

I cannot log into my control panel and the Levelhosting.ca site is down.

Moreover, their Twitter page is unavailable: https://twitter.com/levelhosting and I cannot find them on FaceBook.

Essentially, Im looking for some answers and an ETA.

Actually, preferably to get things restored.

Thank you
Posted by LevelHosting Inc, 05-28-2012, 09:27 AM
Hello IMTeam,

First, I do apologize for the inconvenience caused to you and other customers impacted by the present matter. Regrettably, I cant provide great details or an ETA on the issue. I called into our US provider this early morning and discovered they've been hit with a very large DDOS attack for the last 6 hours. The only ETA we were provided with was, everything should come back online over the next few hours. Also, it appears only a certain segment and portion of their network has been negatively impacted.

We have other servers within the facility both in Dallas & Seattle and these servers have been online and accessible throughout the ordeal. The same applies to our Toronto facility. All servers in Toronto are online and fully reachable. Were hoping to have additional details with the progress of the situation within the next 1-2 hours.
Posted by IMTeam, 05-28-2012, 09:58 AM
All I can say is, "Wow!"

Hurry up and wait... I guess???

sigh...
Posted by LevelHosting Inc, 05-28-2012, 11:23 AM
Everything should be coming online shortly. A few of the servers are back online. Again, we do apologize for the issue as it was completely out of our control. Once we receive a full update from the facility we will be contacting those who were impacted.
Posted by hostvirtual, 05-28-2012, 12:04 PM
levelhosting.ca itself still seems down..

Quote:

levelhosting.ca has address 96.47.42.65

BGP routing table entry for 96.47.40.0/21, version 1270614530
Paths: (34 available, best #34, table Default-IP-Routing-Table)
Flag: 0x820
Not advertised to any peer
1239 3356 36351 21844
144.228.241.130 from 144.228.241.130 (144.228.241.130)
Origin IGP, localpref 100, valid, external
Dampinfo: penalty 490, flapped 1 times in 00:00:25
3277 3267 36351 21844
194.85.102.33 from 194.85.102.33 (194.85.4.4)
Origin IGP, localpref 100, valid, external
Community: 3277:3267 3277:65100 3277:65320 3277:65326 3277:65330
Dampinfo: penalty 841, flapped 2 times in 00:08:07
6079 36351 21844
207.172.6.20 from 207.172.6.20 (207.172.6.20)
Origin IGP, metric 0, localpref 100, valid, external
Dampinfo: penalty 492, flapped 1 times in 00:00:22
3267 36351 21844
194.85.40.15 from 194.85.40.15 (193.232.80.7)
Origin IGP, localpref 100, valid, external
Dampinfo: penalty 488, flapped 1 times in 00:00:33

So i'd guess the attack/work continues. Interestingly that's softlayer/theplanet for the primary www ?

What is strange though is the official twitter account appears to be deleted? IE: http://twitter.com/#!/levelhosting

"Sorry, that page doesn’t exist!" -- must be unrelated
Posted by IMTeam, 05-28-2012, 01:02 PM
Sites are back up and access to control panel and main site has been restored.
Posted by DanJo, 05-28-2012, 08:48 PM

Quote:

Originally Posted by hostedas

levelhosting.ca itself still seems down..

So i'd guess the attack/work continues. Interestingly that's softlayer/theplanet for the primary www ?

What is strange though is the official twitter account appears to be deleted? IE: http://twitter.com/#!/levelhosting

"Sorry, that page doesnt exist!" -- must be unrelated

Seem like they get "double kill" ddos attack and account deleted in tweet(hacker maybe?)
Posted by LH-Jason, 05-29-2012, 12:52 AM
One of the servers from our upstream provider was being DDoS (Distributed Denial of Service) which caused some of parts of the network to not fully function at optimal speed. This impacted a part of the Dallas and Seattle network. From the information provided to us, this began 2AM CST May 28th 2012 and was fully restored by 10AM CST May 28th 2012. Also we removed our twitter account a few weeks ago, since it was not Actively being used.
Posted by CBH-Nick, 05-29-2012, 01:53 AM

Quote:

Originally Posted by LH-Jason

One of the servers from our upstream provider was being DDoS (Distributed Denial of Service) which caused some of parts of the network to not fully function at optimal speed. This impacted a part of the Dallas and Seattle network. From the information provided to us, this began 2AM CST May 28th 2012 and was fully restored by 10AM CST May 28th 2012. Also we removed our twitter account a few weeks ago, since it was not Actively being used.

Did you close your twitter because:
A) It was not actively being used, or,
B) It was compromised

I think the write answer wouldve been B. I (along with all of your twitter followers) received a DM a couple weeks ago saying something like "Someones been spreading rumors about you.. http://phishing-website-here.com". I sent an email to your abuse and never received a response.
Posted by LH-Jason, 05-29-2012, 01:47 PM
The message you received for "Someones been spreading rumors about you.. " was sent to us and someone clicked on it by mistake which caused our followers to start receiving it.
The account was suppose to be closed earlier due to the lack of activity and monitoring.