Kayla

-----

Kayla

Please read the information below carefully if you are located on this server.


The old IP is 66.195.17.208

The new IP is 72.29.74.95


VERY IMPORTANT STEP:

If you do not get to complete this step, your site will not go down, but we would appreciate it if you make the change (as explained here in Extra Notes: http://www.surmunity.com/showthread.php?t=12285).

Please update your domain's DNS to the following:

ns657.dizinc.com
ns658.dizinc.com

Any domain you host on this server, whether it is parked or add-on, please change the DNS of that domain to the DNS above.

If you registered the domain with us you can make this change at
http://www.surpassdomains.com

Otherwise, you need to make this change at the site where you registered the
domain.

If you go to your site and you see a cPanel page that reads "No website configured at this address" that means your local computer
is trying to load your site on the old IP. Simply restart your PC, modem or router so it can release it from cache.

P.S. If you are using an SSL or have a static IP email esurpasshosting.com with your domain name so we can assign you a new static IP and make sure your SSL is working correctly.

Daniel

Hello,

During the last hour or so, SH62 has been under a pretty heavy random source synflood attack against Apache. Because of this, we have had to put access-lists in place on the router which block multiple class A's (ex. 80.*.*.*). The reasoning for blocking class A's is due to the nature of the attack - it is mostly pointless, time and resource consuming to block each random IP that is attacking, as new IP's start attacking within less than a second (ie. random source synflood ;-) ).

For this reason, it is possible that some legitimate visitors/traffic will be blocked from reaching SH62. If this is the case, please submit a ticket with the title "Blocked from SH62" and mention the IP you are trying to reach SH62 from. (ie. your IP).

Currently, the issue seems to be more or less under control - the webserver is certainly accessible, since most of the attacking ranges are getting blocked by the ACL's.

We do apologize for any inconvenience this has caused you, but know that we are doing everything in our power to minimize the effects of this attack.

Sincerely,

-Dan

Emmanuel

sh62 will have a 2 hour downtime window between
6am and 8am Sunday Jan 22 2006 EST. We will be doing
some movement of racks within the datacenter. We
picked this time which has shown to be the least
traffic on the server. We apologize for any inconvenience.

Kayla

If you use any of the following scripts:

FA-PHPHosting
PHPClique
PHPCalendar
PHPCurrently
PHPFanBase
PHPQuotes

Please disable them immediately or use the fix specified below. There are serious exploits going around the net right now and have been for the past few months. All of these scripts are made by http://codegrrl.com/ and have a ridiculously easy hole in them:
"
include($logout_page);
"
This allows an attacker to include whatever code they wish into the php file and run the commands.
To avoid getting your site defaced, we recommend you either remove the protection.php file asap, or edit it and remove that line above.

Andy

Saturday night, June 7th we will be enabling PHP SuExec and upgrading PHP and MySQL to version 5 on sh62.surpasshosting.com.

There will be some minimum downtime past 12am EST.