Aweber down for 2 days? Really?

It might be offline for a while. Depends on how quickly they could respond and mitigate the attack.

That is not the case, he is suggesting using Amazon just as an SMTP server, not the platform. If you host your own platform, which I do, you won't have a problem like this.

I use arpreach if you were wondering, it is self hosted, so there are no monthly fees either, just one hefty fee upfront. Well define hefty, its not really that bad.

It's terrible it causes any sites with an Aweber script to load crazy slow as well.

They say " If you're website is loading slowly because of the JavaScript from your AWeber form, simply add the word "defer" to the script. This will resolve the site loading issue. Example: "...script defer type..." "

Anyone try it? It would be a pain to edit a bunch of scripts and then I assume have to edit them back again.

No bueno...

Hey Paul,

Maybe you could go over and help them since there HQ is in PA. Seriously, this is not a good thing for windstreambusiness.com either, which is AWeber's third party security network.

DDoS attacks have been going on for many years but like you say there is more firepower... and obviously more idiots.

In the last few weeks there have been a lot of IM related sites heavily attacked. Coincidence or planned? Only the bad guys know I guess.

I thought it was on my end that i couldn't login to Aweber. Just didn't enter my mind that Aweber would be hacked. Just goes to show that no one is safe.

Truly weird, I do not have any aweber forms or an account
yet my site is slow to load, and the add on bar in firefox states that it is awaiting
forms.aweber.com.....

I am going to deactive the plugins one at a time, see if that helps

But they're down so how can they do that?

"Unprofessional?" Really?

I have to say, I find the misuse of that word to be among the least professional things I see here on a regular basis. Is a law enforcement officer "unprofessional" because his bulletproof vest wouldn't protect him from the crushing force of a tank?

I recommend that you sue whatever school(s) you may have attended for failing to teach you even the most basic skills needed to deal with a complex world. Notable among the lack, "It is unwise to express definitive opinions on subjects about which you know nothing at all."


Paul

Nope, not for me yet. I'm going to bed now, and hopefully Aweber will be up by the time I wake up.

Really people? They are on Windstream. When your "Top Tier" email provider uses bailing wire and tin cans to build their infrastructure, your going to have issues. Awebers frugal decision making has now cost them. And if your buying this was a DDoS then I have a bridge to sell you.

The form on my site is showing, and i've successfully opted in as it appears in my gmail account. I am assuming my free guide is downloading... or would but I need to update its delivery URL.

It appears that everyting is as was, but cannot yet vouch for opt-ins other than my own.

What's the status right now? Can anyone load the forms yet?

In my case, I am able to log into aweber.com - but none of my forms are showing up (stinks - I am in the middle of a launch today - could not have been worse timed than this).

On my new launch site, I have added the aweber Javascript as "defer" so the rest of my page is not getting blocked because of it - just in case that helps anyone.

Webforms weren't showing for me. I was using Javascript, I updated my website to us RAW HTML, saved it and my webform showed. Confirmation email sent correctly and my follow up started. Just a tip for anyone that had this issue.

Still down for me (I'm in southern Spain). Developing a site locally, all good yesterday, but still no forms showing for me.

Tried removing code/widgets and re-installing them, no luck, same problem. Links in yesterdays test email confirmations all working though.

Emailed aWeber!

Yet another reason to call them "zombie attacks." They get people reacting without thinking.

Consider the goals of a person who would launch an attack like this. If they aren't trying somehow to get the data (which seems an unlikely end result for this approach), they're trying to damage the target business. How do you do that with a subscription-based system? Chase off their customers.

There are other damages involved, to be sure. The costs involved in mitigating an attack like this aren't trivial. Still, the target is likely to be the customer base.

The more effective they are at that, the more likely they are to do it again in the future. So, you're encouraging them with this line of response.

That aside, nobody is immune to the kinds of DDoS attacks that can be launched these days.

A recent attack involved a single command-and-control server and somewhere in the 4000-5000 zombied computers range. It directed over 300 gigabytes of data per second at the target system. There's a known exploit that would allow that same sub-section of a botnet to generate substantially more dataflow.

Now, imagine a botherder using multiple servers and a large chunk of one of the major nets in a similar attack. You could be talking 10s (possibly 100s) of thousands of zombied machines in a concerted assault.

The volumes could easily reach terabytes per second.

I doubt there are any paid services you use that could withstand that kind of attack.


Paul

Yup, both GetResponse and AWeber are down for me too.

Sean,

That's like saying a bank should be prepared for some random bus to drive by and have a dozen people spraying armor-piercing bullets through the windows with no thought of getting the money that's in the vault.

Or that a convenience store, knowing that they're targets for robbery, should have walls that stand up to a tank.

I don't think you quite grok the scale or mindless destructiveness involved in the recent attacks. You simply cannot be prepared for this sort of thing. Not while operating in a fiscally responsible fashion.


Paul

In order to protect their servers on this type of attack the protection would cost more than $3000 per server per month. It could even cost more. Aweber has a lot of servers. It is very possible aweber did not want to spend money on this protection in order to be price competitive. This cost would need to be passed on to the members.

I've had the aweber scripts on all my sites for years, now, how come they never scanned me? With or without aweber, my chances of getting a DDoS attacks remain the same. In fact, they will drop because I won't be using the same addlead.pl form submit file like everyone else. I'm using a generic php form script which I can rename to anything I want.

My sites are up yet Aweber has been down again just 30 mins ago. So I'm not jumping to another target, I'm getting RID of a target that's clearly been hit and, because of those scannings you were talking about, I was pointing right at them. Soon there will be nothing tying me to Aweber or get response or any of those big name companies that have been hit.

Yes - there's another issue right now. And yes - other companies are being hit, also. I opened a new post the other day that another service I use was down when I tried to log into them, so it's not just Aweber.

Here's my thinking - I have been with Aweber for 9 years and this is the first outage that I can remember. If I manage to move all my subscribers over to a new service, I may just be setting myself up for another attack by this hacking group. How much fun would it be to start picking on the next guy? Imagine all the new and transferred accounts you could upset when you're done with Aweber.

I'll stick with Aweber for now to see how it shakes out. I may not have the size business of some of you and that affects my decision. How much time and money will it take for you to move somewhere else?

My background is IT, so I know what is involved and I know small businesses don't have the budget to protect against these types of hackers. To get as large as Aweber, you have to grow your staff along with your security. Hackers will always be there to find the next crack to penetrate. Unfortunately, they're picking on Aweber right now; who will be next?

And whoever said they don't have the staff to work weekends? Anyone can spread propaganda like that - it creates fear. Could be the hackers themselves.

I think the DDOS attack #3 has started. Aweber does not have the protection they need to defend against these DDOS attacks and this may continue on and off for many weeks.

I think when the dust settles I will be looking to closing my aweber account. Just one day is a major impact for me not to think about these problems to continue week after week.

If you guys are worried to host your own script, here's an email service company that works specifically with Amazon's SES:

OngageConnectâ„¢- Amazon SES

50 bucks/mo for 200k emails. Add 20 more from Amazon's charges and you're still half price compared to Aweber.