Sunday, January 20, 2008

Update: Rapidshare shut down?

Currently rapidshare.com is not working but rapidshare.de is.

The site allegedly went black around 0200 GMT on the 19th and was reportedly back up again around 0730 GMT and went down again.

Users have been experiencing errors such as: "The following error was encountered: * Connection Failed The system returned: connection refused"

A Wikipedia entry was made that read: "As of 19 January 2008 16:00 GMT, Rapidshare AG’s servers were shutdown by anti-piracy authorities in Germany. More than hundreds of Rapidshare servers were seized from their offices in Berlin although no arrests were made. Sources said, authorities are contemplating pursuing legal action against users who distribute and download pirated copies of software and movies from these servers." 

It was quickly removed.

Rapidshare.com, formerly Rapidshare.de, has been widely used as a vehicle for the transfer and sharing of pornography. Site such as HCMF.com commonly used the site as a means of perpetuating the illegal sharing of pornography.

Rapidshare.com, and Filefactory.com have also been abused by spammers, says Dave Marcus, security research and communications manager for McAfee's Avert Labs.

The "official" word is that the downtime is said to have been caused by a server overload.

Rapidshare technician Steven Gircham has reportedly commented on this issue - "There are rumors concerning attacks made on the Rapidshare.com servers. There are also rumors that Rapidshare has been shut down by a court order. These rumors are false. We would like to apologize to our users and inform them that no data has been lost. There have been some hardware issues as a result of high bandwidth and server overload. We are doing our very best to resolve the hardware issues, and users should expect uptime by midnight tonight (GMT)"

you can still view the site via IP - 80.239.151.250 - But it could be just a shell.

They either got DOS attacked, and are having trouble getting there DNS working or they want it to at least appear that way. 

rapidshare.com (DNS and web) is hosted on a net block of 195.122.131.0 - 195.121.131.255 (also referred to as 195.122.131/24 CIDR) which is part of a larger block 195.122.128.0 - 195.122.191.255 owned by Level3 UK service provider.  

Level3 appears to be blocking inbound traffic destined for 195.122.131.0/24 at the edge of their network and their routers are dropping all rapidshare.com traffic such as DNS, web, etc. This is the point where they peer with other service providers.

This is highly unusual.

This is a drastic measure and one can only surmise two reasons that make any sense. 1) denial-of-service or 2) legal action. 

If the inaccessibility issue has been intermittent, (and there have been spotty reports) that's a hint it's probably a denial-of-service attack. However, if it's immediate and sustained then it's most likely legal.

No comments: