I can understand the attacks but there still seems to be traces of someone fucking something up on the backend. For example, having to click an extra time to get to the forums.
That doesn't look to me like an attack but someone who doesn't quite know how to fix what they broke themselves.
not at all, that looks to me more like a way to redirect traffic to a different machine while a dns change takes place or simply in case they can later switch traffic back to the original machine
looks ugly but whatever works is fine (of course that it could be done in more elegant ways via NAT translations but anyway......)
A dns change that takes 4 days? Ok, then someone ELSE doesn't know what they are doing.
Oh well, good luck with the attacks I guess...