Cyber attack forces Wikileaks to change web address

Wikileaks had defended its decision to publish thousands of secret documents

Whistle-blowing website Wikileaks has been forced to change its web address after the company providing its domain name cut off service.

EveryDNS.net said it had terminated services because Wikileaks.org had come under massive cyber attacks.

But Wikileaks has already reappeared using a Swiss web address.

Wikileaks has also used the micro-blogging site Twitter to urge its fans to redistribute its "raw" net address so it can be viewed at any time.

This numerical internet protocol (IP) address remains live and accessible even when web domains - the normal "www" addresses used to access most sites - are unavailable.

Experts say it is likely that Wikileaks has done deals with lots of web hosting companies, although many are likely to back away from dealing with the controversial site in the light of recent web attacks.

There is also a published list of mirror sites, which Wikileaks hopes will provide constant access to the site.

Some of these sites have simply copied Wikileaks' content and put it on a different web server, while others are using different domain names to point at the original content.

The more of these sites there are, the more difficult it will be to shut Wikileaks down, security analyst Paul Mutton told the BBC.

In France, Industry Minister Eric Besson has called for a ban of Wikileaks on French servers.

One of the mirror sites, Wikileaks.ch, is currently hosted on servers in France.

Downtime

In a post on Twitter, Wikileaks acknowledged that its domain had been "killed" by EveryDNS.net.

It was not clear how long disruption to the wikileaks.org site would last.

In a statement on its website, EveryDNS.net said it had issued a 24-hour termination notice to Wikileaks which ended at 0300 GMT on 2 December.

It said the domain wikileaks.org had become the target of "multiple distributed denial of service (DDOS) attacks".

"These attacks have, and future attacks would, threaten the stability of the EveryDNS.net infrastructure, which enables access to almost 500,000 other websites," it said.

"Any downtime of the wikileaks.org website has resulted from its failure to use another hosted DNS service provider," it added.

Websites use hosting firms such as EveryDNS.net to translate their raw IP addresses to a more memorable web address such as Wikileaks.org.

But the IP address of a website will also direct users to the site.

One web expert explained that Wikileaks had managed to re-establish web access via a different address.

"Users visiting the www.wikileaks.ch website appear to be directed via a Swedish website on to a server in France which is now hosting their main website," explained Sebastien Lahtinen, director of web hosting firm NetConnex.

In a surprising twist, the .ch address is also hosted by EveryDNS.

"It seems a strange choice given that they pulled the plug on the .org address just a few hours ago," said Paul Mutton, a security analyst at internet services firm Netcraft. "It could be that Wikileaks is quite happy to play a cat and mouse game with them," he added.

'Death threats'

Using a Swiss domain could be Wikileaks anticipating the next line of attack - having its IP address de-registered, thinks Mr Mutton.

"Moving to a non-US domain makes sense. Its previous domain was registered with a US company and as such has to work within US laws, with potential for the government to lean on it and get it suspended," said Mr Mutton.

Wikileaks founder Julian Assange is currently reported to be staying at a secret address in the UK.

In a question-and-answer session on the website of the Guardian newspaper, he said there had been threats against his life.

"We are taking the appropriate precautions to the degree that we are able when dealing with a super power," Mr Assange wrote.

He also called for criminal charges to be brought against Tom Flanagan, a former adviser to Canada's prime minister Stephen Harper.

Mr Assange was referring to Mr Flanagan's comments that "Assange should be assassinated... I think Obama should put out a contract ... I wouldn't feel unhappy if Assange does disappear".

When asked about the alternatives for Wikileaks' cache of material if it were to be "taken out" technically, Mr Assange said: "The Cable Gate archive has been spread, along with significant material from the US and other countries to over 100,000 people in encrypted form.

"If something happens to us, the key parts will be released automatically. Further, the Cable Gate archives is in the hands of multiple news organisations. History will win. The world will be elevated to a better place. Will we survive? That depends on you."

Wikileaks says its website has been under attack since it began publishing more than 250,000 classified US diplomatic cables.

The memos, which discuss US diplomatic relations and military activities, have been causing controversy across the world.

It turned to the online store Amazon to host its site but the company ended the agreement on Wednesday - a move welcomed by US officials.

Amazon said that it had not removed Wikileaks because of a government inquiry. Instead it said Wikileaks had failed to adhere to its terms of service.

"It's clear that Wikileaks doesn't own or otherwise control all the rights to this classified content. Further it is not credible that the extraordinary volume of 250,000 classified documents that Wikileaks is publishing could have been carefully redacted in such a way as to ensure that they weren't putting innocent people in jeopardy," Amazon said on its website.

But freedom-of-speech campaigners remain defiant.

"The first serious info war is now engaged. The field of battle is Wikileaks. You are troops," tweeted John Perry Barlow, founder of the Electronic Frontier Foundation.