We are expecting this update to take about 9 hours but could run longer if a transfer fails and has to be restarted.

Start Time: Sunday, March 30, 2025 @ 1:00 am

Expected End Time: Monday, March 31, 2025 @ 10:00 am

The post Maintenance Window appeared first on Tarheel Media Digital Marketing.

How this attack works

These attacks do not require a server or network vulnerability. Attackers overwhelm resources with legitimate-looking requests to exhaust CPU, memory, connection slots, or packet-handling capacity. Imagine a PO box that receives so much bulk mail in one day the post office must start returning mail because there’s no room — that’s what a DDOS does to a server.

This is what tipped us off:

What we observed

Typical VLAN traffic averages about 35 kbps. During the attack we saw interfaces stuck at 4+ Mbps, which is alarming even though the network can carry more than 10 Gbps. The problem here is packets-per-second that strain routers, not raw bandwidth. If we weren’t using octa-core routers and modern edge filters, some services would have dropped.

All traffic used user-agents reporting Mac 11 and Chrome 87, which we believe are forged. The bulk of requests originated from IP ranges in China, with occasional sources in the U.S., EU, and Russia. Right now they appear to be targeting an American Christian church site for bandwidth exhaustion.

On other sites, such as an office furniture site, attackers retried repeatedly over several hours to force downtime:

Mitigation status

So far we have mitigated the attack and it has not grown in strength. We have seen short bursts since it began, but upstream filters and our edge rules have been effective.

We have collected more than 11,000 IPs making blanket requests. As upstream providers apply filters, the attackers’ effectiveness drops and the attack eases.

The attack pattern looks random across subnets and networks. It does not appear to target a specific site type beyond being U.S.-focused.

UPDATES

5:46 am: Our upstream providers report this may form part of a larger campaign meant to strain United States internet infrastructure. They see similar attacks across many customers.

5:52 am: We have almost entirely neutralized the initial DDOS surge.

11:00 am: Attackers shifted to Slowloris-style tactics, attempting to hold many slow connections and strain servers at the application layer. We adjusted timeouts and connection handling and again mitigated these attempts. The transition is visible below:

3:35 pm: Issue closed. Attacks have ceased and we do not expect further impact to our services at this time.

We will continue to monitor traffic and remain in constant contact with upstream providers. If anything changes, we will post updates here.

The post DDOS Attack on Web Ports appeared first on Tarheel Media Digital Marketing.

The post DNS Issue Reported appeared first on Tarheel Media Digital Marketing.

HOW WE PROTECT YOUR DATA

We use a hybrid system to guarantee power to all servers during power loss.  Every server rack has a 30-minute UPS (uninterruptible power supply) which gives us time to spin up the generator.  The generator can power both servers and air conditioners and recharge the UPS systems.  Our weakest link is Spectrum Enterprise which is our only fiber provider for the entire area.

DATA AFFECTED DURING EXTENDED POWER LOSS

If we lose connectivity to Spectrum Enterprise or they lose connectivity to the internet, some data clusters for our cloud services will not work and some data may not be available such as:

• Cold Storage Files (large files and videos or old photos you rarely access)
• Statistics Applications (long-term data for stats.tarheel.media)
• Any other custom application you may be running on your website (WooFoods, Games, etc)

WHAT WE WILL DO IF WE ARE OFFLINE

While offline there will be nothing we can do until we’re online again.  We will do our best to keep you up-to-date via email and updates on this post, so please bookmark this page as soon as possible.

The post Natural Disaster Preparedness for Hurricane Idalia appeared first on Tarheel Media Digital Marketing.

Update @ 0814: The issue was identified as a corrupted route in the router when trying to automatically get routes from the border-gate community.

Update @ 0811 : There was some additional outage with the switching of traffic.

We have detected an intermittent outage on the primary router in Virginia.  We have switched traffic to North Carolina until this is resolved. You may notice your website be unresponsive for a few moments when we switch back.

The post Service Outage Detected June 15, 2023 @ 0800 appeared first on Tarheel Media Digital Marketing.

There is a reason why I said most, though. These kinds of updates where the back-end software gets a big upgrade which exposes us to more settings to better optimize a website, en masse, means that some of our client’s older websites simply did not benefit and cannot benefit without an entirely new restructure and re-design of the frameworks that they run on.

For example, Goldsboro Web Development stopped updating websites to PHP 8.0 which ran frameworks built before 2018 back in 2022. Essentially, when PHP updates it can require such a re-write of code that it would not be covered under our update policy. We provide free maintenance and security updates when it is available to us. An update that would break your website or require us to entirely rewrite most of the code is simply not covered and while we’ll support the code for as long as possible it is a good idea to start thinking about upgrading the website if it is placed on End of Life status by us.

As of now, websites created before 2019 are hitting their End of Life for updates to PHP. If we were able to update your website to PHP 8.1, it will be the last time we update your website to a major version of PHP. Now as security updates come out for PHP8.1.x we’ll apply them, without any doubt, but we will not be able to update your website to PHP 8.2 without an entire rewrite of your code, and most certainly PHP 9.x is out of the question.

How can you identify if your website has hit end of life?
Simply log in to your website’s back end, and there will be an alert at the top of every page in the administrator’s control panel.

How urgent is it that you upgrade?
Soon. We could run into an issue we can’t upgrade you out of today, tomorrow, next week, or next year or next decade. When your website hits this status, you’ve pretty much hit that 100,000 mile mark on a vehicle. Anything could go wrong at any time and there are simply no more guarantees that we can fix it for less than what it would take to buy a whole new website.

The question is, how brave are you? If you have a 50-foot ladder and the manufacture advises that the aluminum weakens after 10 years and therefor they cannot be responsible for death or injury and will not warranty the ladder after that period, would you keep using that ladder after 10 years?

Are there any reasons we may shut down the website if you don’t upgrade?
Yes. If your website becomes compromised and WordPress or PHP does not or has not released any security fixes for it, your website will be suspended until you can either pay for an upgrade or pay for us to go through and update the code. Keep in mind that if we’re paid to just fix the code, that doesn’t guarantee this won’t happen the very next day. Once code ages like this it becomes a domino effect simply because updates slow down or stop. To-date we’ve never had to shut down a website even when one customer had a nearly 20 year old website – one of our first! Because we were proactive at blocking many attacks at the network level through packet filtering and application filtering, the only thing that necessitated his upgrade was to bring his website to be mobile friendly and responsive. Because it’s possible doesn’t necessarily mean it will happen, only that it can happen.

How much would a new upgraded website cost?
That’s really the good news. Because you already have a website built by us, your content, images, etc can be directly reused to create nearly 60% to 100% of your new site lowering the price tag from the thousands of dollars to just a few hundred. Depending on your unique website, it could cost $600 or $1600 and getting quotes as low as $400 is not unheard of if your website was fairly simple to begin with.

The post Server Maintenance & Website Legacy Support End of Life (EOL) appeared first on Tarheel Media Digital Marketing.