Event Espresso was under a DDOS Attack Today

On Monday, October 27, 2014 EventEspresso.com was targeted by a distributed denial of service attack. This works by flooding our servers with dummy requests so that authentic requests from real website visitors are not processed. If you tried to access our website earlier today, then you may have experienced one of the following:

  • slow website loading
  • 502 bad request
  • partial loading or broken styling on various pages

No customer information has been affected and all customer data is safe.

Some initial findings on this attack has been posted here: http://status.eventespresso.com/update-on-service-interuptions/

We will be conducting a full investigation of this attack over the next few days and will provide another update once this has been completed. We are very sorry about any inconvenience that this may have caused today.

Additional availability by our team will be made for tomorrow (October 28th). If you recently created a support post in our support forums, then you’ll receive a response soon. Have a question about your Event Espresso account or a recent purchase? Get in touch with our team through our contact page:¬†https://eventespresso.com/contact/

This is an unfortunate way to start out the week and we are very grateful for your patience.

Related Articles

4 thoughts on “Event Espresso was under a DDOS Attack Today

  1. My IP has also been attacked a few times. It is annoying and scary at the same time. I had to purchase a new IP and move all my websites to the new IP to avoid it. What is the point of these stupid attacks anyway. Glad to see you got it sorted.

    • Thanks Judy! Sorry to hear that you have faced the same situation. Fortunately, we were able to pinpoint how it was happening and patch up the server and some inefficient code that made the DDOS attack possible.

  2. Hey Guys,

    Sorry to hear about the attack – we got hit also.

    Would love to hear what your findings are and your methods moving forward to stop the problem happening again. It might help us to formulate a plan ourselves.

    Chris

    • Thanks lutand!

      In our case, the attackers were able to expose an attack vector on our server using the api we have in place for recording stats and for receiving update requests to the plugin update engine. Our developers spent the majority of the day putting in place some measures to prevent DDOS attacks in the future and implemented some rate-limiting on the api endpoints for our plugin update engine. While doing this, we also noticed an inefficient query that compounded the server problems and we fixed that.

      Preventing attacks in the future
      I’m not sure of the attack vector used in your specific case, but the primary fix for us was that we implemented rate-limiting on the exposed api endpoints and added some ddos rule protection to protect against wp-login.php flooding.

      In addition to the above, we also installed the WP Spam Shield plugin to prevent spam user registrations. On average, a new spam account was added every three minutes. Since adding the WP Spam Shield plugin, our spam user registrations have dropped substantially.

      I hope this info helps. We will try to post more about the situation as soon as we can.

Share a Reply or Comment

Your email address will not be published. Required fields are marked *

Need help with Event Espresso? Create a support post in our support forums

Do NOT follow this link or you will be banned from the site!
[gravityform id=116 title=false description=false]
<div class='gf_browser_unknown gform_wrapper' id='gform_wrapper_116' ><form method='post' enctype='multipart/form-data' id='gform_116' action='/2014/10/event-espresso-was-under-a-ddos-attack-today/'> <div class='gform_body'><ul id='gform_fields_116' class='gform_fields top_label form_sublabel_below description_below'><li id='field_116_5' class='gfield gfield_contains_required field_sublabel_hidden_label field_description_below gfield_visibility_visible' ><label class='gfield_label gfield_label_before_complex' >What is your first name?<span class='gfield_required'>*</span></label><div class='ginput_complex ginput_container no_prefix has_first_name no_middle_name no_last_name no_suffix gf_name_has_1 ginput_container_name' id='input_116_5'> <span id='input_116_5_3_container' class='name_first' > <input type='text' name='input_5.3' id='input_116_5_3' value='' aria-label='First name' aria-required="true" aria-invalid="false" placeholder='First name'/> <label for='input_116_5_3' class='hidden_sub_label screen-reader-text'>First name</label> </span> </div></li><li id='field_116_1' class='gfield gfield_contains_required field_sublabel_below field_description_below gfield_visibility_visible' ><label class='gfield_label' for='input_116_1' >What is your email address so we can follow up with you?<span class='gfield_required'>*</span></label><div class='ginput_container ginput_container_text'><input name='input_1' id='input_116_1' type='text' value='' class='medium' placeholder='hello@example.com' aria-required="true" aria-invalid="false" /></div></li><li id='field_116_2' class='gfield gfield_contains_required field_sublabel_below field_description_below gfield_visibility_visible' ><label class='gfield_label' for='input_116_2' >Tell us about your concerns below<span class='gfield_required'>*</span></label><div class='ginput_container ginput_container_textarea'><textarea name='input_2' id='input_116_2' class='textarea medium' placeholder='What kind of events are you planning?' aria-required="true" aria-invalid="false" rows='10' cols='50'></textarea></div></li><li id='field_116_6' class='gfield field_sublabel_below field_description_below gfield_visibility_visible' ><label class='gfield_label' >GDPR Agreement</label><div class='ginput_container ginput_container_checkbox'><ul class='gfield_checkbox' id='input_116_6'><li class='gchoice_116_6_1'> <input name='input_6.1' type='checkbox' value='I consent to have this website store my submitted information so they can respond to my inquiry.' id='choice_116_6_1' /> <label for='choice_116_6_1' id='label_116_6_1'>I consent to have this website store my submitted information so they can respond to my inquiry.</label> </li></ul></div></li><li id='field_116_3' class='gfield gform_hidden field_sublabel_below field_description_below gfield_visibility_visible' ><input name='input_3' id='input_116_3' type='hidden' class='gform_hidden' aria-invalid="false" value='' /></li><li id='field_116_4' class='gfield gform_hidden field_sublabel_below field_description_below gfield_visibility_visible' ><input name='input_4' id='input_116_4' type='hidden' class='gform_hidden' aria-invalid="false" value='https://eventespresso.com/2014/10/event-espresso-was-under-a-ddos-attack-today/' /></li><li id='field_116_7' class='gfield gform_validation_container field_sublabel_below field_description_below gfield_visibility_visible' ><label class='gfield_label' for='input_116_7' >Comments</label><div class='ginput_container'><input name='input_7' id='input_116_7' type='text' value='' autocomplete='off'/></div><div class='gfield_description' id='gfield_description__7'>This field is for validation purposes and should be left unchanged.</div></li> </ul></div> <div class='gform_footer top_label'> <input type='submit' id='gform_submit_button_116' class='gform_button button' value='Send my message' onclick='if(window["gf_submitting_116"]){return false;} if( !jQuery("#gform_116")[0].checkValidity || jQuery("#gform_116")[0].checkValidity()){window["gf_submitting_116"]=true;} ' onkeypress='if( event.keyCode == 13 ){ if(window["gf_submitting_116"]){return false;} if( !jQuery("#gform_116")[0].checkValidity || jQuery("#gform_116")[0].checkValidity()){window["gf_submitting_116"]=true;} jQuery("#gform_116").trigger("submit",[true]); }' /> <input type='hidden' class='gform_hidden' name='is_submit_116' value='1' /> <input type='hidden' class='gform_hidden' name='gform_submit' value='116' /> <input type='hidden' class='gform_hidden' name='gform_unique_id' value='' /> <input type='hidden' class='gform_hidden' name='state_116' value='WyJbXSIsIjBiNjdjZjkyMDUzOWUxOWY5Y2NiZjIwMzM4YjA1Mjk4Il0=' /> <input type='hidden' class='gform_hidden' name='gform_target_page_number_116' id='gform_target_page_number_116' value='0' /> <input type='hidden' class='gform_hidden' name='gform_source_page_number_116' id='gform_source_page_number_116' value='1' /> <input type='hidden' name='gform_field_values' value='' /> </div> </form> </div><script type='text/javascript'> jQuery(document).bind('gform_post_render', function(event, formId, currentPage){if(formId == 116) {if(typeof Placeholders != 'undefined'){ Placeholders.enable(); }} } );jQuery(document).bind('gform_post_conditional_logic', function(event, formId, fields, isInit){} );</script><script type='text/javascript'> jQuery(document).ready(function(){jQuery(document).trigger('gform_post_render', [116, 1]) } ); </script>