Coin Fire DDOS Attack Underway

Back to Crypto-News

Comments

MikeJohnson

Offline
Posts: 427

Coin Fire is currently experiencing a massive DDOS attack.

This attack is unlike any other DDOS attack we have ever encountered.

We aren't the only site suffering from this attack at this time as it seems to be targeting several cryptocurrency related sites including Piece of Bit, Chain Radio and for a time even the FTL radio site.

We have been paying members of CloudFlare for sometime and this attack seems to be zeroing in past the standard CloudFlare protections by hitting our content management system WordPress.

We've been working actively with our hosting providers for the last several hours as we continue banning new IP addresses and even disabling large portions of our WordPress install to combat this attack.

We've deployed several new CDN machines, we've deployed several blacklists to stop new IPs that continue cropping up and even gone as far as blocking several massive IP ranges and even entire ISPs in an effort to regain site functionality.

Ourselves, Chain Radio, Piece of Bit and upwards of 25 other sites are seeing massive slow-downs or even page load failures and the common element is that we are all WordPress users and all cryptocurrency sites.

I wanted to drop an update in here as to why our site is failing at this time and assure everyone we are working very diligently and if necessary through the night to resolve this issue and hope to be back soon.

Posted on September 10, 2014 at 7:44 PM

1 like

• Cryptonaut

  

  Offline
  Posts: 1944
  Location: Canada

  damn man, that sucks! Hopefully those script kiddies get bored and quit soon. Heres hoping that they dont try targeting LTB next :p

  Posted on September 10, 2014 at 7:53 PM
  Permalink
  0 likes
• MikeJohnson

  

  Offline
  Posts: 427

  @cryptonaut damn man, that sucks! Hopefully those script kiddies get bored and quit soon. Heres hoping that they dont try targeting LTB next :p

  Yeah they are using a generic script. We blocked that script from accessing anything and they switched to a variant of it. You might want to just go ahead and ban the user-agent

  [% tools.ua.random() %]

  http://security.stackexchange.com/questions/65870/new-ddos-attack-on-wordpress-website

  It is WordPress specific at the moment. Can't wait to ditch WordPress and switch to tokenly ;)

  Posted on September 10, 2014 at 8:06 PM
  Permalink
  1 like
• MikeJohnson

  

  Offline
  Posts: 427

  After incurring over $1,200 of expenses last night that our provider DEMANDED we pay immediately due to the damages happening from the DDOS attack (that we paid but the site was still down) we have now learned that they have permanently disabled our account and deleted all of our data.

  At this time they are seeking an additional $1,900 to enable access to our account and recover costs associated with the attack last night and to restore our data once again.

  I just wanted to give this update and say we are working on restoring our site. Sadly, we've learned that many other sites are having debates right now if they will even come back because last nights DDOS attack cost them just as much money or more and many are debating if they want to keep having these sort of weekly battles still.

  Posted on September 11, 2014 at 6:26 AM
  Permalink
  0 likes
• MikeJohnson

  

  Offline
  Posts: 427

  Update

  After a few calls from our attorneys we were able to get our service restored to the point that we are able to get our data out at the very least.

  We are unable to state who our provider is until we have moved everything (fear they will shut it back off) but we are working actively right now to move our data out and off to another provider.

  Posted on September 11, 2014 at 7:11 AM
  Permalink
  0 likes
• ChainRadio

  

  Offline
  Posts: 161

  We suffered a similar attack last night and the one against us is still ongoing. We are hoping to get our stuff back online again soon but we can't use CloudFlare to protect our streaming servers and this is a very intense attack.

  Posted on September 11, 2014 at 8:34 AM
  Permalink
  0 likes
• MikeJohnson

  

  Offline
  Posts: 427

  Update

  We have been able to bring Coin Fire back online at this time.

  Our team will be working nearly around the clock today to migrate our data and setup new systems to further prevent this type of attack in the future.

  Posted on September 11, 2014 at 8:45 AM
  Permalink
  1 like
• Cryptonaut

  

  Offline
  Posts: 1944
  Location: Canada

  so were these guys demanding a ransom payment or something, or just DDOSing for the hell of it?

  Posted on September 11, 2014 at 9:49 AM
  Permalink
  0 likes
• ChainRadio

  

  Offline
  Posts: 161

  They demanded a ransom from us. Guessing the same for a few others.

  Posted on September 11, 2014 at 9:49 AM
  Permalink
  0 likes
• jamesmm

  

  Offline
  Posts: 131
  Location: Texas, Block #301130

  Uhg, i really hate to hear that. You might try locking down wp-admin using .htaccess.

  In my experiences this stops them pretty well. Here's a link to the tutorial I use to enable it: http://www.inmotionhosting.com/support/website/wordpress/prevent-unauthorized-wp-admin-wp-login-php-attempts

  The main down fall is it takes 2 passwords to access the wp-admin after using this method. So not very good if you have multiple users logging into wp-admin. But it should stop the attackers. I manage about 35 WP sites, and I sleep a lot better having this on all of them. :)

  Posted on September 11, 2014 at 12:00 PM
  Last Edited: September 11, 2014 at 12:01 PM
  Permalink
  0 likes
• MikeJohnson

  

  Offline
  Posts: 427

  We actually had been using that method. The exact method of attack was against comment forms.

  Then it evolved ultimately to a direct flooding of our providers root DNS servers.

  I am going to be beefing up our wp-admin and wp-login security further this week.

  Thanks for the tips!

  Posted on September 11, 2014 at 12:40 PM
  Permalink
  1 like

Post Reply