[anti-censorship-team] DDoS on Greenhost, may affect Snowflake

[Cecylia Bocovich]

Hmm, interesting.

Looking at broker metrics from the last couple days:
https://snowflake-broker.torproject.net/metrics

There may have been a small drop in client match counts (from ~10,000 to
~9000) but nothing like a total outage.

It looks like there was a drop in bridge users on the 16th but not an
obvious drop in the date range of the DDoS attack:
https://metrics.torproject.org/userstats-bridge-transport.html?start=2020-12-10&end=2020-12-21&transport=snowflake

Thanks for the heads up. I'll keep an eye on the metrics because it
sounds like it's still ongoing?

Cecylia

On 2020-12-20 3:46 p.m., David Fifield wrote:
> Greenhost sent an email saying that since last 2020-12-17, there has
> been a DDoS attack against their infrastructure. This may affect
> Snowflake, because the broker and bridge are hosted by Greenhost in
> Amsterdam.
>
>> Please bear with us as Greenhost and the eclips.is platform are
>> suffering from some of the largest DDoS attacks we have faced.
>>
>> Between Thursday and now we have seen targeted attacks on one of our
>> users and directly at Greenhost.
>>
>> Our upstream provider in Miami has unfortunately completely dropped
>> the eclips.is infrastruccture routing as they could not withstand the
>> attacks. We are working to put that connectivity back up as we speak.
>>
>> The situation in Amsterdam is more under our control, and both
>> Eclips.is and Greenhost networks are available as of writing.
> 2020-12-17 09:10 outage caused by a major DDOS attack
> https://status.greenhost.net/incidents/19
>
>> Since 10:10 CET, we have been experiencing outage caused by a major
>> DDOS attack.
>>
>> All VPSes, webhosting and emailservers were affected by this outage.
>>
>> We have deflected the attack and worked to recover all systems.
> 2020-12-20 15:00 Repeated DDoS attacks on our infrastructure
> https://status.greenhost.net/incidents/20
>
>> After the DDoS attack last Thursday we did see recurring attacks of
>> increasing magnitude on our infrastructure. We are working through the
>> weekend with our technical service providers to increase resilience of
>> our network. We will update you as the situation progresses. At this
>> point our services are operational.
> _______________________________________________
> anti-censorship-team mailing list
> anti-censorship-team at lists.torproject.org
> https://lists.torproject.org/cgi-bin/mailman/listinfo/anti-censorship-team