Statement from PatrickPretty.com

This has just come through from Patrick Pretty

Sunday, October 24, 2010 – PatrickPretty.com was informed this morning by WebHost4Life, the PP Blog’s hosting provider, that its CGI account has been “suspended” over an issue pertaining to “load.” The site went down yesterday without warning. Customer Support assured the Blog repeatedly that specialists were seeking to restore its functionality and ability to publish.

This morning came the news that the company itself had taken the Blog offline.

WebHost4Life did not describe what caused the “load” issue on the server; it simply took the Blog offline, and blocked the Blog’s access to its own database. PonziNews.com also was taken offline by Webhost4Life.

These actions by WebHost4Life came without warning. The Blog never has received any kind of correspondence from the company on issues pertaining to server load. The Blog has been a Webhost4Life customer since December 2008. Our content well includes more than 950 stories on the subjects of online fraud schemes, pyramid schemes, Ponzi schemes and other topics of interests to consumers. All of the stories, which represent two years’ work and research, have been taken offline.

Thousands of comments from readers also have disappeared as a result of the unannounced “suspension.”

The PP Blog will seek an explanation from senior management at WebHost4Life. We have expressed our dissatisfaction at the actions of the company and the explanations provided so far by Support personnel and a technician.

Suspending an account without warning on a Saturday – while at once providing no guidance on the specific problem and threadbare information on the cause and blocking access to the Blog’s own database – is unacceptable.

PatrickPretty.com
Covering Ponzi Schemes, pyramid schemes, securities fraud, investment fraud and Internet crime.

Hello RealScam.com,

I've chatted with a few of you here. It's good to know that some serious-minded folks are seeking to educate the public about the schemes that are draining billions of dollars down a giant sinkhole. It is my belief that these schemes pose an unprecedented challenge to law enforcement.

Wanted to let you know that the PP Blog issued this statement today, Oct. 27, 2010:

A DDoS-like traffic surge disabled the PatrickPretty.com Blog. The PP Blog, which covers Ponzi schemes, pyramid schemes, securities fraud and online crime, lost its ability to publish as a result of the surge, and has been offline since Saturday, October 23.

The surge appears to have begun on Oct. 23. During the surge, the Blog received more than 6.1 million (6,154,701) “hits.” The Blog ordinarily receives between 20,000 and 30,000 hits on an average day.

Engineers have described the surge as “suspicious,” saying it led to an “immense” amount of traffic to the Blog. The surge appears to have been most intense during a specific, three-hour window.

PatrickPretty.com is temporarily moving its publishing operations to PonziNews.com. Engineers are seeking to determine the cause of the DDoS-like surge. The PP Blog began covering Ponzi schemes in August 2008. It specializes in reporting on illegal or highly questionable business pursuits such as autosurf “advertising” schemes, HYIP (High-Yield Investment Program) schemes, and multilevel-marketing (MLM) frauds such as 2x2 matrix cyclers.

The full statement is available in PDF format at PonziNews.com:

STATEMENT: PatrickPretty.com News Website Knocked Offline By Mysterious Traffic Surge; Blog That Covers Ponzi Schemes And Online Fraud Got Millions Of Unexplained ‘Hits’ During 3-Hour Window | Ponzi News

Patrick

Hi Patrick

Bad news but why am I not surprised to hear that it may have been something similar to a DDOS attack that put you offline. It is a tribute to the accuracy of your reporting on the subject of illegal and questionable businesses and HYIPS that some people would rather that the information you send out is NOTavailable to the public.

Hope it is fixed quick, and meanwhile, look forward to reading your Ponzi News blog. They wont be able to keep the truth from view for long.

I most certainly hope that Patrick and the webhosting company take the time to report the DDoS attack to the FBI Website

This is NOT a simple matter of a few good ol' boys playing a prank.

DDoS attacks are nothing less than cyber terrorism and their usage to stifle free speech should be treated as a criminal offence of the utmost seriousness.

Hi LRM,

The PP Blog will cooperate fully in efforts to investigate this incident.

Patrick

Is there a site problem again? I can't seem to get it to load. Just gives me a blank screen.

Whip,

This appears to be another DDoS attack. It also has taken out PonziNews.

Patrick

Patrick, this sucks immensely!! Seems like someone doesn't like you exposing them as crooks. So, you must be doing the right thing with your articles. Keep up the good work!!

It's about this time that even the most disinterested lawmaker MUST be at least starting to realize we are not simply talking about a bunch of jolly jokers making a few bucks on the side here.

We are talking about an organized, (albeit loosely) and well funded criminal conspiracy/ies which are not only skimming off billions from the world economy, but are developing/have the capacity to wreak havoc on the 'net world as we know it.

Today it is "only" the Patrick Pretty blog,

to morrow ???????????????????????

Andy Bowdoin was caught with around $90 MILLION in the ASD accounts.

Yet over 250 MILLION passed through the accounts during the life of ASD, much of it untraceable and a great deal of it distributed to overseas accounts.

Fund much havoc with $160 MILLION, anyone ??????

Quick update: The PP Blog was targeted yesterday in a sustained DDoS attack that was described by engineers last night as even more severe than the attack last week that disabled the site for four days. A comprehensive report is being prepared for law enforcement. The Blog will remain offline indefinitely.

It looks as though the attack actually began anew over the weekend, building into a sort of grand-mal attack sometime between 3 p.m. and 4 p.m. ET (U.S.A.) yesterday. These numbers are preliminary and may change, but it looks as though more than 10 million hits were directed at the Blog in a concentrated attack from specific locations during the final days of October. The attack began to affect network operations, and the Blog was taken offline for security reasons. The Blog survived for only five days, after it was brought back online after the initial attack.

Not only are criminals employing technology to suck wealth down a giant sinkhole, they also are using technology to wage war against the 1st Amendment. The PP Blog and PonziNews both have been disabled. Every single link that leads to stories, images, court filings and information that shines light on fraud has been fractured. More than two years' worth of research and reporting effectively has been rendered inaccessible. The outward casualty is more than 1,000 stories. More than 9,000 comments from readers, including researchers, Ponzi scheme victims, pyramid scheme victims and victims of other types of victims of online fraud, also cannot be accessed by the public.

Patrick

A couple of quick points in response to the attacks on the Patrick Pretty blog:

Anyone who thinks what has happened is, in some way "funny" or "poetic justice" would do well to consider for a moment the implications such attacks raise.

Quote:

---

North Korea blamed for DDoS attacks on United States and South Korea Dan Raywood July 09, 2009

A series of distributed denial-of-service attacks on American and South Korean websites have been blamed on North Korea.


The Associated Press has claimed that South Korean intelligence officials believe that North Korea or pro-Pyongyang forces in South Korea committed cyber attacks that have hit the websites.

A spokesperson for the state-run Korea Information Security Agency spoke on condition of anonymity citing the sensitivity of the information, but refused to allow the name of the lawmaker he works for to be published. Meanwhile the National Intelligence Service said it could not immediately confirm the report.

Agency spokesperson Ahn Jeong-eun claimed that 12,000 computers in South Korea and 8,000 computers overseas had been infected and used for the cyber attack and said it believed the attack was ‘thoroughly' prepared and committed by hackers ‘at the level of a certain organisation or state'.

---

North Korea blamed for DDoS attacks on United States and South Korea - SC Magazine UK

Quote:

---

CNN Web site targeted

ATLANTA, Georgia (CNN) -- CNN was targeted Thursday by attempts to interrupt its news Web site, resulting in countermeasures that caused the service to be slow or unavailable to some users in limited areas of Asia


CNN took preventative measures to filter traffic in response to attempts to disrupt its Web site.


http://i.cdn.turner.com/cnn/.element...er_wire_BL.gif


"CNN took preventative measures to filter traffic in response to attempts to disrupt our Web site. A small percentage of CNN.com users in Asia are impacted," the network said in a statement.
"We do not know who is responsible, nor can we confirm where it came from," the statement continued.
A CNN spokesman said the Web site began to notice problems around midday Thursday and took measures to isolate the trouble by limiting the number of users who could access it from specific geographic areas.
As a result, he said, some users in those areas experienced temporary slowdowns or problems accessing the site.
The spokesman could not offer an estimate of how many users were affected. However, he said that the impact on daily usage was "imperceptible" and that the site "at no time" went down.
Service had returned to normal by mid-morning Friday, he said.

---

CNN Web site targeted - CNN.com

Is anyone sure just where these attacks are originating ????

Anyone still think it only happens to "little fish" ????

This is not just "serious"

this is now BLOODY serious

I'm very sorry to your sites continue to be targeted, Patrick. But in a way this is a form of compliment, someone finds you, your reporting and the comments there on to be so threatening that they're willing to pay other criminals to keep your site offline. Damn Dude I always knew you were good but now we have proof that you're good enough for someone to sick the botnet on. Frustrating to be sure, but in it's own way flattering as well.

I hope you'll be able to keep up the good work and very soon. :RpS_smile:

Quote:

---

Originally Posted by GlimDropper

I'm very sorry to your sites continue to be targeted, Patrick. But in a way this is a form of compliment, someone finds you, your reporting and the comments there on to be so threatening that they're willing to pay other criminals to keep your site offline. Damn Dude I always knew you were good but now we have proof that you're good enough for someone to sick the botnet on. Frustrating to be sure, but in it's own way flattering as well.

I hope you'll be able to keep up the good work and very soon. :RpS_smile:

---

Hello Glim,

Thank you for your note. I'm working on getting things up and running again. You mentioned the comments from readers at the PP Blog. The simple math of that is that more than 9,000 were temporarily wiped away by the DDoS attack. Links within the comments to other resources also were wiped away. For example, if I was writing about a specific Ponzi scheme or investigation -- and if a reader left a link to, say, a complaint filed by the SEC or another investigative resource -- the link was wiped away. Those links were important because they potentially could be used to connect dots between and among various schemes.

As a result of those links, I was able to tie a company currently under investigation for a Ponzi scheme to at least four other Ponzi or fraud schemes. The report on the ties also was wiped away, of course. Also gone is all the ASD and HYIP coverage, including coverage of schemes that targeted people of faith, senior citizens, people of color and people with conditions such as hearing loss, multiple sclerosis and cancer.

This is just preliminary, but it looks as though the attack was launched from hundreds of IPs. If viewed as a 24-hour event, one of the IPs was "hitting" the Blog three times per second for all 86,400 seconds of the day. Another was hitting the Blog more than one time per second. Yet-another was hitting the Blog approximately every other second. Scores of IPs sought to load hundreds of pages in a compressed time frame.

The Blog recorded more than 13.8 million hits during the attacks. Bandwidth consumption was tremendous -- in the multiple hundreds of GBs.

Thanks for your note, Glim.

Patrick

Holy Crap!! Please clarify what you mean when you say comments and coverage was "wiped away." I did see the word temporary in there, I do hope you mean that your content is backed up and can be restored, otherwise we need to start mining Google's cache. You seem to have opted out of Archive.org, at least they don't list any of your pages since 2008 but for the time being I am able to pull up some of your pages through google.

Please do clarify if you have lost any content, if so I'll post a step by step for saving pages and perhaps we can organize a retrieval effort. After all, it is your site but some of those comments were ours and we want them back where they belong.

No content -- including reader comments -- appears to have been lost, Glim, but I am still in the process of looking at files. I have the databases and the site folders, including the graphics. "Wiped away" was in a temporary sense.

On a side note, the COMPRESSED archive (server logs) that captured the DDoS attack is 65.2MB.

Patrick

Patrick,

I hope you will feel very welcome here. Thankfully, ChrisDoyle and Ohein56, the witless MLM enthusiasts, haven't darkened our doorstep here. Feel free to link all of your blogs here and do consider posting them here as well. Glim or I can set you up a forum of your own right here. I think you would be an incredible asset to this site. Let us know what you would like to do.

Soapboxmom

Quote:

---

Originally Posted by PPBlog

This is just preliminary, but it looks as though the attack was launched from hundreds of IPs. If viewed as a 24-hour event, one of the IPs was "hitting" the Blog three times per second for all 86,400 seconds of the day. Another was hitting the Blog more than one time per second. Yet-another was hitting the Blog approximately every other second. Scores of IPs sought to load hundreds of pages in a compressed time frame.

The Blog recorded more than 13.8 million hits during the attacks. Bandwidth consumption was tremendous -- in the multiple hundreds of GBs.

---

If this series of attacks are "normal" investigators will probably find that most, if not all the offending communication requests which caused the problem will have been from "zombie" computers owned by innocent web users whose machines have been hijacked and programmed to carry out the attacks, making it well nigh impossible to trace the "botmaster/s"

To make investigation even more difficult, the offending machines are most probably spread worldwide and have been ordered to carry out the attacks at intermittent times during the attack period.

Patrick is in good company:

Quote:

---

Internet 'attack' in Burma ahead of poll

• AAP
• November 04, 2010 3:24PM

A MASSIVE cyber attack has crippled internet services in Burma ahead of Sunday's election, IT experts and web service providers say, raising fears of a communications blackout for the vote. Internet users in the military-ruled country have reported slow connections and sporadic outages for more than a week, and some suspect the junta may be intentionally disrupting services to block news flowing out.
Web service providers have blamed the troubles on outside attacks.
"Our technicians have been trying to prevent cyber attacks from other countries," a technician from Yatanarpon Teleport Co told AFP on condition of anonymity.
"We still do not know whether access will be good on the election day," he added.
A technician from private web provider RedLink Communications Co. said there was still intermittent loss of internet connection.


"The technicians are trying to fix it.... We cannot tell exactly when it will be back to full service," he said. "We don't know the source of the attack yet."
Experts say Burma's internet system has been overwhelmed by a flood of incoming messages known as a Distributed Denial of Service (DDoS) attack.
US-based IT security firm Arbor Networks says the main state-owned internet provider Burma Post and Telecommunications "suffered a large, sustained DDoS attack disrupting most network traffic in and out of the country."
The onslaught was "several hundred times" more than enough to overwhelm the country's terrestrial and satellite links, it estimated.
The motives for the attack were unclear, but "large-scale geo-politically motivated attacks -- especially ones targeting an entire country -- remain rare," Arbor Networks chief scientist Craig Labovitz wrote in a blog posting.

---

Internet attack in Burma ahead of poll

Quote:

---

Originally Posted by Soapboxmom

Patrick,

Feel free to link all of your blogs here and do consider posting them here as well. Glim or I can set you up a forum of your own right here. I think you would be an incredible asset to this site. Let us know what you would like to do.

Soapboxmom

---

Hello SBM,

Thank you for your kind words and for making this offer.

My approach so far has been to address the continuing security threat to the Blog first. I believe I am making some headway in that area, but a few wrinkles remain.

Patrick

Quote:

---

Originally Posted by littleroundman

If this series of attacks are "normal" investigators will probably find that most, if not all the offending communication requests which caused the problem will have been from "zombie" computers owned by innocent web users whose machines have been hijacked and programmed to carry out the attacks, making it well nigh impossible to trace the "botmaster/s"

To make investigation even more difficult, the offending machines are most probably spread worldwide and have been ordered to carry out the attacks at intermittent times during the attack period.

---

Hi LRM,

I don't know precisely how things will unfold; I do know that five federal agencies have been made aware of the attack.

Patrick

The PP Blog has returned. We will carry on -- at the site, here and elsewhere.

PPBlog

Quote:

---

Originally Posted by PPBlog

The PP Blog has returned. We will carry on -- at the site, here and elsewhere.

PPBlog

---

Glad to hear it!

Soapboxmom