Greenhost incident

Networking issues causing packet drop or delays

Minor Resolved View vendor source →

Greenhost experienced a minor incident on April 6, 2022, lasting 23d 4h. The incident has been resolved; the full update timeline is below.

Started
Apr 06, 2022, 08:23 AM UTC
Resolved
Apr 29, 2022, 12:56 PM UTC
Duration
23d 4h
Detected by Pingoru
Apr 06, 2022, 08:23 AM UTC

Update timeline

  1. investigating Apr 06, 2022, 08:23 AM UTC

    Around 10.23 CET we discovered network disruptions towards our infrastructure. This caused packet loss or slowness on some routers/paths. After investigating we discovered issues at the Amsterdam Internet Exchange (AMS-ix),however, at 10.45 traffic recovered. We are waiting for clarifications from AMS-ix, meanwhile we monitor traffic closely and will reroute traffic if the problems at AMS-ix reoccur.

  2. resolved Apr 06, 2022, 09:52 AM UTC

    AMS-ix confirmed the exchange is currently stable. We will continue to monitor the connections closely.

  3. resolved Apr 29, 2022, 12:56 PM UTC

    ### RFO (Reason for Outage) Event Report * Issue summary On 2nd April our hosting platform was subject of an outgoing DDoS attack that partially affected VPSes and hosting services. * Incident timelines - 2022-04-02 - 22:22 - Attack starts making some VPSes and hosting services unavailable. - 2022-04-02 - 23:15 - VPSes are fully available as well as e-mail, shared hosting websites are partially unavailable - 2022-04-03 - 00:50 - All shared hosting is up - 2022-04-03 - 09:00 - Small amount of shared hosting websites present unavailability due some changes in the infrastructure - 2022-04-03 - 19:37 - All shared hosting is up * Root cause A [vulnerability](https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/) on the wordpress tatsu plugin was exploited to launch a DNS amplification attack through vulnerable sites. * Affected services - Partially cloud virtual machines - Partially Hosting services - Partially Mail services * Corrective/Preventative actions - Upgrade the vulnerable plugin on the affected websites - Improve platform restrictions to avoid future attacks - Improve monitoring