[Updated] Former Sen. Norm Coleman’s Web site is down, and the campaign says a flood of info-seeking disenfranchised voters overwhelmed it. A press release posted at the GOP blog Minnesota Democrats Exposed reports that the site was “inundated by tens of thousands of hits today – temporarily crashing the website.” MDE’s Ryan Flynn then quotes Coleman campaign manager Cullen Sheehan (Fox 9 also published the release).
“Minnesotans and folks across the country are fed up with Al Franken’s efforts to disenfranchise thousands of Minnesota voters, and the overwhelming response we received to making this information public is proof positive of that fact,” he says.
But not so fast, says Aaron Landry, an MN Publius blogger (and Franken fan) who works as IT Manager at a St. Paul design firm by day. He commented at MDE that there’s “no way that the amount of traffic they got was the cause of the website being down.”
Then he did some digging. His conclusion: “This stunt is a completely fabricated lie.“
Two of the four points Landry makes in his post:
2. Their website has been configured to point at the IP address “1.1.1.1,” which goes nowhere. This isn’t a mistake. They also set the “time to live” on that for only 600 seconds, which means when they choose to switch it back, most servers should only take 10 minutes to refresh. It’s an intentional move so they can manage their timing of the switchover. Most records like this have a much longer time to live. In short, they have configured their website to intentionally point at nothing. This does not happen by mistake and it is clear what they are doing.
[...]
4. As the Coleman for Senate website is being pointed at 1.1.1.1, which goes nowhere, they have no way of tracking how many “hits” they are getting. They had to have made up the “thousands of hits” number because it is technically impossible to track traffic they aren’t receiving.
I left messages on the office voicemail and cellphone of Coleman’s press officer, Luke Friedrich, and called and e-mailed his backup, Tom Erickson. Should they reply, I’ll post what they have to say. I’m also getting in touch with IT experts who can weigh in on Landry’s claim.
Update: Tony Webster, a Minneapolis web developer, explained to me that the IP address the Coleman campaign used prior to today’s “crash” (208.42.168.197) is responsive. Translation: “If the site was truly down, that IP wouldn’t be responsive. If it wasn’t, their story might have validity. In fact, I can see their last blog post today. The title is ‘Senate Trial: Every ballot has a story.’ If the site was down, I wouldn’t see that at all.”
He says he can also see that the campaign has a Google Analytics account.
“If they wanted to be transparent, they could release those logs and graphs,” he said. “Since it’s a third-party source, they can’t modify the data. If they changed that DNS [to 1.1.1.1] to mitigate a problem, you should see it.”
Update: I called Tim Barsness listed as the technical contact for the site. The provided phone number rang to Coleman’s campaign office; while Barsness was not available, the unidentified man who answered the phone would say little, except to inform me that the problem was being worked on as we spoke — and to correct me: “The crash happened yesterday.” That assertion sets off a red flag for Tony Webster: If that’s true, why does he see two entries dated today? He took a screen grab of how the Coleman site’s HTML displays on-screen, taken directly from the site’s server:
Still no response to my multiple messages left with Coleman representatives at 2 pm this afternoon.
Related: ‘Crashgate’ reveals unprotected donor database on Coleman’s site














44 Comments »
Comment posted January 28, 2009 @ 3:09 pm
If they pointed their DNS at 1.1.1.1, it would do exactly what they claim. But, the coleman campaign is the only one that would have the permissions to make that change, so they did it to themselves, either by mistake or on purpose.
It’s a pretty dumb mistake, and pretty obvious. DNS is available for the world to see, so the error is right in the open for anyone to see.
Comment posted January 28, 2009 @ 3:51 pm
what about Ryan Flynn. So he’s the new Coleman webmaster I’m assuming. Does this guy have any nerd ethics? I hope he hasn’t shot himself in the foot.
Comment posted January 28, 2009 @ 4:22 pm
They did this at the same time Coleman gave that fallacious interview to Sean Hannity where he claimed MoveOn and Soros were behind Franken and he needed help from “good Americans”. Is this basically playing to the base for money to pay his lawyers? I’m sure Ginsburg doesn’t come cheap.
Comment posted January 28, 2009 @ 5:43 pm
Sounds like whoever is making decisions for Coleman is still operating under the old Republican rule that we are all stupid…which is why Coleman lost the race. It’s all over except for the attorney bills…that Franken should sue Coleman for since Normy said if it was him he would not sue…….LOL
Liars…but we all knew Coleman was a liar didn’t we?
Comment posted January 28, 2009 @ 5:45 pm
Great reporting. Thank you.
Comment posted January 28, 2009 @ 5:57 pm
The brilliant web developer is obviously making some huge assumptions with what is going on with the Colman website. I know that there is another reason for the crash. Get the facts before you left wing bomb throwers make these ridiculus accustions. This is typical of the people who just want to spread their hate.
Comment posted January 28, 2009 @ 6:13 pm
John, the story is chock full of facts. ?
Comment posted January 28, 2009 @ 6:29 pm
And that reason would be…?
If it’s a mistake, it’s a mistake. Just be straight about it. Otherwise, they got busted.
Comment posted January 28, 2009 @ 6:39 pm
John H,
Sorry to inform you that the brilliant web developer isn’t making any assumptions, you are.
The reality is that anyone who manages Internet resources would be able to diagnose the source of the problem rather quickly.
Just like the attempt to forge ballots as evidence of wrongdoing, a real expert can see right through it. Is it spreading hate? More like Coleman trying to spread lies.
Truth hurts doesn’t it?
Domain name: colemanforsenate.com
Registrant Contact:
Liz Maruggi
Maruggi Liz
570 Asbury Street, 201A
Suite 11
St. Paul
MN, 55104 US
+1.6515561846
cdsheehan@yahoo.com
Administrative Contact:
Liz Maruggi
Maruggi Liz
570 Asbury Street, 201A
Suite 11
St. Paul
MN, 55104 US
+1.6515561846
cdsheehan@yahoo.com
Technical Contact:
Tim Barsness
Coleman for Senate
570 Asbury Street
Suite 201A
St. Paul
MN, 55104 US
+1.6516450766
tim@barsnesssolutions.com
host colemanforsenate.com
colemanforsenate.com has address 208.42.168.251
colemanforsenate.com mail is handled by 10 mail.colemanforsenate.com.
Comment posted January 28, 2009 @ 6:50 pm
Great reporting! Investigative journalism at it’s best. The whole idea is to make sure the public knows the truth about what’s going on so that we can’t be manipulated. Looks like Norm Coleman has serious egg on his face—-again. Yesterday the Huffington Post headlined a story about Bank of America hosting a large conference call before the election (but after they took taxpayer bailout money) for the purpose of stopping the labor law that would make it less possible for business to intimidate workers from joining a union. In the transcript of that call it is said that if the workers win that it “would be the end of a civilization as we’ve known it”. Norm Coleman’s name was specifically mentioned as a crucial person in making sure the workers didn’t earn this right to join a union more privately. Hey Minnesotans, do you think that working people do better if they stick together or do you think they do better if corporations decide what’s good for them?
Comment posted January 28, 2009 @ 6:55 pm
To John H….
You “know” there is another reason for the crash? Is there a reason why you aren’t supporting your accusation?
Smells like baloney to me.
Comment posted January 28, 2009 @ 6:56 pm
“I know that there is another reason for the crash” alright Mr. H, what are they? What are your crazy non left-wing accusations and assumptions? Your comment is an insult to all web developers whether they be left, right, middle, or in outer space. The updated information presented is not an assumption, it is a fact, a technical verifiable fact from here to Silicon Valley. Computers don’t lie. If their web server was actually inundated, we wouldn’t be able to access their IP directly. What is more significant is that the web community here is rather embarrassed this Ryan Flynn did not go to more realistic lengths to fake server downage. There are more realistic ways to fake a network outage that would not be verifiable.
Similar on Webster’s point, let us see the Google Analytics! There is an option in Google Analytics to allow outsiders to view the traffic graphics unadultered unmodified and straight from Google’s mouth. If there was truly an intense surge in activity, we will see it.
Comment posted January 28, 2009 @ 7:39 pm
John H,
Why am I sensing a lot of hate spreading from your post?
What is _your_ reason for the crash? Would you care to share with the rest of the class?
Oh, and btw, here, I got a Razor for ya. Don’t cut yourself.
Carry on,
~ Latte
Comment posted January 28, 2009 @ 7:46 pm
Is it this easy to create an admin account at colemanforsenate.com?
http://flickr.com/photos/adriarichards/3234818883/
Comment posted January 28, 2009 @ 8:28 pm
If their website crashed there a reasons…which can be discerned by regular troubleshooting which they can make public. Assertions that this is faked can be proven false in a libel suit.
Come on Coleman ….sue us. When we prove your shakanery you will be hit with counter suits for defamation of character which will be easy to win.
Comment posted January 28, 2009 @ 8:38 pm
“Get the facts before you left wing bomb throwers make these ridiculus accustions. This is typical of the people who just want to spread their hate.”
John H.
If you would read through the article it is full of facts. And as far as hate mongers, Rush, BillyO, Hannity, Beck etc. have no peers when it goes to spewing hate. You seem to fit right in with them. With people like you and them and Bohner and McConnel the Republican party is on life support.In four years you will be gone and this country can recover its grace and compassion.
Comment posted January 28, 2009 @ 8:48 pm
There was no corresponding increase in my voting article traffic so I think
Norm is lying. There should be increases across the web for articles and stuff about
the election. There isn’t any election stuff really going, (check the Indy logs) so Norm is telling fibs.
Comment posted January 28, 2009 @ 9:14 pm
“The brilliant web developer is obviously making some huge assumptions with what is going on with the Colman website.”
Oh really, John? His evidence is rock solid and easily verifiable. Do you have an actual rebuttal?
Comment posted January 28, 2009 @ 9:27 pm
“John H
Comment posted January 28, 2009 @ 5:57 pm
“The brilliant web developer is obviously making some huge assumptions with what is going on with the Colman website. I know that there is another reason for the crash. Get the facts before you left wing bomb throwers make these ridiculus accustions. This is typical of the people who just want to spread their hate.”
I’m sure all of us “left wing bomb throwers” would be happy to look at your “facts,” IF YOU HAVE ANY. Ball’s in your court, Herr Goebbels. Where are these lovely plump facts you speak of?
Comment posted January 28, 2009 @ 9:28 pm
Oh, dear – poor John H!
There is plenty of actual fact to back this story’s claims.
It has nothing to do with hate, as you surely know: it is about the Coleman campaign sputtering lies desperately, as they teeter on the edge of oblivion.
If you want to refute this story, then do so with some facts: not your blundering, emotive trollop.
Comment posted January 28, 2009 @ 9:55 pm
That image isn’t HTML code. That’s a screen shot of the display. It does show multiple entries form today, but I’m not sure what that means. It occurs to me they could have had a crash unrelated to traffic, and said it was traffic without confirming it was so.
John H, if you “know” there is another reason for the crash, please share it. I’m willing to allow the possibility that someone who put out the story that the crash was caused by traffic got the story very wrong and didn’t check their facts, and that this would constitute a mistake, not a lie, but I claim this only as a possibility. I don’t know. That the story is wrong seems clear, and only whether it was a screw up or a lie is the question. I hate to think people would lie like that, but I saw the clip of Coleman on Hannity, so yes, I do think Coleman is capable of out and out lying.
Comment posted January 28, 2009 @ 10:17 pm
I was a bit confused by the point of the images – since Eric is right – they aren’t html code.
Comment posted January 28, 2009 @ 10:32 pm
It’s a display of the HTML, which I have as well. My error in terminology, Eric and Eva.
Comment posted January 28, 2009 @ 10:40 pm
Coleman just leaked his whole database: http://208.42.168.251/colemanforsenate.com/db/database.tar.gz
Comment posted January 28, 2009 @ 11:04 pm
EPIC’s right, it looks like everything is there, wide in the open, for the taking. In all honesty, someone should alert the Coleman campaign, as that’s a lot of private data being exposed on the Interwebs and partisanship aside, it ought not to be exposed.
Comment posted January 29, 2009 @ 1:16 am
I think Coleman need to spend more money in hiring a real Internet professional to do his bidding. My 14 year old nephew shown me the IP was reponsive – which indicated that the site was not down. Of course, Coleman’s audience is not of 14 year old variety. Otherwise, the race would have been a landslide for the former comedian.
Comment posted January 29, 2009 @ 6:09 am
Next time you idiots want to do this, just set apache to use only 1 worker!
Comment posted January 29, 2009 @ 7:13 am
here’s how to fix senator coleman’s website:
http://bit.ly/31Arv3
–timball
Comment posted January 29, 2009 @ 8:28 am
Thank you for the great reporting, MnIndy!
Comment posted January 29, 2009 @ 9:39 am
Coleman people probably just goofed up so made up the high traffic story to save face. I doubt it was a complicated scheme. People mess up all the time, especially incompetent Republicans.
Comment posted January 29, 2009 @ 11:55 am
Has anyone seen John H.? Shouldn’t he have been able to come up with some “facts” to support his idiotic post. Ooops, that was hateful wasn’t it.
John? John? Has anyone seen John?
Comment posted January 29, 2009 @ 1:21 pm
Brought down by DOS attack – CAIR or other muslim extremists acting online do this all the time. Wake up, Americans!
Comment posted January 29, 2009 @ 1:28 pm
Uh, ok, James. Thanks for commenting.
Comment posted January 29, 2009 @ 3:03 pm
Coleman you are a LOSSER!!!!!!!!!!!!!!!!!
Comment posted January 29, 2009 @ 3:07 pm
More than 24 hours into this, and still no public statement from the Coleman camp explaining the DNS switch, etc? Their silence gets more and more damning by the hour.
I do predict that in the end they’ll cook up some sort of DDOS attack-related excuse, though …
Comment posted February 2, 2009 @ 8:06 am
This is another important piece of the puzzle.
I would surely like a look at their log files.
Whois: 208.42.168.251
OrgName: Vector Internet Services, Inc.
OrgID: VECT
Address: 10290 W 70th St
City: Eden Prairie
StateProv: MN
PostalCode: 55344
Country: US
NetRange: 208.42.0.0 – 208.42.191.255
CIDR: 208.42.0.0/17, 208.42.128.0/18
NetName: VECTOR-BLK2
NetHandle: NET-208-42-0-0-1
Parent: NET-208-0-0-0-0
NetType: Direct Allocation
NameServer: NS.VISI.COM
NameServer: NS2.VISI.COM
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 1999-07-16
Updated: 2005-04-29
RTechHandle: VISIN-ARIN
RTechName: VISI NOC
RTechPhone: +1-612-395-9030
RTechEmail: noc@visi.com
OrgAbuseHandle: VISIA-ARIN
OrgAbuseName: VISI Abuse
OrgAbusePhone: +1-612-395-9011
OrgAbuseEmail: abuse@visi.com
OrgNOCHandle: VISIN-ARIN
OrgNOCName: VISI NOC
OrgNOCPhone: +1-612-395-9030
OrgNOCEmail: noc@visi.com
OrgTechHandle: VISIH-ARIN
OrgTechName: VISI Hostmaster
OrgTechPhone: +1-612-395-9010
OrgTechEmail: hostmaster@visi.com
# ARIN WHOIS database, last updated 2009-02-01 19:10
# Enter ? for additional hints on searching ARIN’s WHOIS database.
Other WHOIS Servers: AfriNIC APNIC
Comment posted March 11, 2009 @ 4:52 pm
Isn’t this what “happened” to Joe Leiberman’s website when he was running against Ned Lamont in Connecticut? I seem to remember this 1.1.1.1 thing is what was found after Leiberman claimed Lamont crashed his site.
Comment posted March 13, 2009 @ 11:30 am
Does anyone notice this… a lot of the replies on here that are rather hateful of Mr. Coleman also have serious spell issues. You’d think they were either hopping mad to the point of not being completely coherent, or they just have a serious lack of education. Funny stuff.
Now; from an “admin’s” perspective. This might be innocent enough and usually can be verified by pulling and looking at logs not only from the servers, but also the nearest router/managed switch. It’s not uncommon when making serious changes to a site that sometimes those changes are so large, you must pull the server “offline” and stop traffic from getting to it. Normally a mirror is up somewhere and you simply put a temporary pointer in DNS to the mirror while you work on the problem(s). Someone here may have been making changes and didn’t either know of a mirror, or just decided to close shop while they changed or updated the file tree on said server. I might even think to do that if it were only temporary. User browser space hitting it would get the usual 404 error during the “outage”.
Just a hunch.
Comment posted March 13, 2009 @ 11:44 am
“spell issues”?
Pingback posted March 13, 2009 @ 5:56 pm
[...] In late January, accusations started flying that former Sen. Norm Coleman’s (R-Minn.) campaign had concocted a story that its Website had crashed after a torrent of visitors flooded it seeking information on whether they were among voters whose [...]
Pingback posted March 15, 2009 @ 12:21 am
[...] Minnesota blog, the Minnesota Independent, devolved further and found some [...]
Comment posted April 1, 2009 @ 11:30 am
Appreciate the info guys, thanks
Comment posted April 12, 2009 @ 10:54 pm
I like this theme you are using… what is it?
Pingback posted November 30, 2009 @ 10:07 pm
[...] Coleman’s website problems started long before I found his unprotected database. The programmer who designed the site, did [...]
RSS feed for comments on this post. TrackBack URL
Leave a comment