Are there any sites that sell portable ip address blocks like this [url], but for the united states? I can't really read that site, but it looks like for 150 euros a month you can get a 256 portable IP address block. 89.36.148.0/23 seems to be a block purchased from them [url], then routed to AWKnet.
View 14 RepliesWhere can I purchase a Cisco switch in Chicago? (2960G-24, to be specific)
View 4 Replies View RelatedI've been searching Google for a few days in hopes of finding companies that take off lease server equipment (sometimes almost brand new) and auctioning it off to people.
I've been buying alot of equipment through resellers of these places but I would like to cut out the middle man expense and bid for myself.
For example. This week I purchased ten Dell PowerEdge R200's with X3220 Xeon CPU's in them. These are fairly new. I don't want to buy first generation single-core xeon servers.
Look forward to finding out who is supplying these people.
I've noticed that one of my "competitor" fansites has gone into redemption. Just like mine, this site was completely non-profit, but unlike mine it had not been updated for about 3 or 4 years!
Now before you mention it, yes I would like some traffic from the site, but I'd much rather not see another standard site published by a company that buys old domains and sells them on. It's extremely frustrating when you click on a link and get a site filled with google adwords, absolutely no information and a "Buy this domain" link.
I'm not planning to automatically redirect anyone to my site from it, but rather post some information on what's gone on and a list of where they can find the information they were probably after including sites that I do not own.
What is the best way to purchase the domain?
How can I find out exactly when it will run out and be available?
Is there any way to preorder it or anything like that?
The only info I can find is:
Registrar: EASYSPACE LTD.
Whois Server: whois.easyspace.com
Referral URL: [url]
Name Server: NS1.MYDYNDNS.ORG
Name Server: NS2.MYDYNDNS.ORG
Name Server: NS3.MYDYNDNS.ORG
Name Server: NS4.MYDYNDNS.ORG
Status: redemptionPeriod
Updated Date: 29-jul-2008
Creation Date: 19-jun-2000
Expiration Date: 19-jun-2008
I realise that a lot of providers build theirs from parts, but I was wondering where I could find some cheap low - mid range servers already built (or at least with the case etc).
I have tried searching eBay, but it's difficult to find what I am looking for. Are there any large companies out there? I am from Australia, and from what I can see there aren't really any around from here. (Looking for an upgrade for my colo).
Will it be a problem if I purchase a SSL certificate, but my current webhost doesnt support it?
I plan on purchasing the SSL now, and then later move the webhosting to a site that supports it?
As many of you may have already read my initial review or the New York NOC I wanted to leave an additional exit review of the company and share a personal recommendation.
It started a little over a month ago when I jumped VPS providers and initially purchase 2 VPS plans . Initially the boxes were rock solid. I could get to my websites, admin area, and have support tickets responded to in a timely manner. Roughly a week later I ended up moving another site to it’s own VPS . This is when I noticied my first issues. CONSTANT ERROR MESSAGES stating the backend was down and to please restart it.
I would launch a support ticket, roughly 2 hours later the backend would be rebooted and I could once again access the admin panel and do what I needed to. Like clockwork when I would try to login again later to my admin panel I would be hit again with the backend was down (hypervm would be in a constant refresh). Sometimes my sites would remain online and sometimes they would go down too. This got frustrating but was bearable (I thought). Within a few days I see a BIGGER problem arise. I woke up one morning to find error alerts coming in and realizing 2 VPS’s had been offline for hours on end. I again launch another support ticket for the backend to be rebooted. I get a response everything is ok so I go about my day. I later receive an e-mail stating all of my sites were showing a mysql connect error and panic. Come to find out they had corrupted this time when the backend went down, I repair and optimize and everything is ok. VERY next day I wake up and check my nightly logs to make sure the nightly backup was loaded onto my home server. I don’t see it and find I received an e-mail from lxadmin stating it could not backup the database. Once again…..corrupted. This has been going on since that time frame on almost a daily basis. The backups are iffy if they will come in since when the backend gets overloaded and crashes in the middle of the night, it immediately corrupts all db’s on the VPS. I could understand 1 VPS doing this…..but 3? Come on….
Now comes Thanksgiving, my boxes go down for roughly 5 hours before reboot and once again I have to repair them on a blackberry with ssh since I am away (never fun to type that on a bb). I am back online and go about my day…….then…..Friday. My box goes down at 5pm…..I send in a support ticket to have it rebooted. The next morning at 11am it finally gets turned back on and I get a response that it must have been on my end since everything looks ok from there (granted 3 monitoring services were all showing it down). Once again…..corrupted. I rebuild and think the SLA was 99.9% so I send in a nice message to ask about it. Here is the response:
Posted: 11/29/2008 12:33
Hey Guys.
Since one of the VPS accounts was down for 17 hours do I qualify for the 99.9% SLA?
(3 Monitoring Services show the outage happened at 5:34PM last night and I have recovery notifications for this morning at 11:16AM)
Thanks
----------------------------
IP Address: 71.76.239.xx Andy
StaffPosted: 11/30/2008 20:49 Hi Ryan,
Unfortunately our SLA applies to network uptime and not power or hardware related.
I'm sorry for the inconvenience.
-------------------------------
The New York NOC Inc.
www.thenynoc.com
Visit our new forums! [url]
So……99.9% SLA does not cover if no one is in the datacenter to reboot the box because it is off-line…..I thought SLA’s covered your box being on-line, am I wrong?
So now after too many corruptions to count, support taking longer and longer in between responses I am left looking over my books. Last year alone between Thanksgiving and the following Sunday I brought in roughly $2300 dollars in sales. This year for the past 4 days I have brought in $10…… I have had some longtime recurring customers so I asked them for any feedback on what we could do to earn there business again. Out of 40+ people all but one stated that if I could fix the sites downtime they would return (the other responses was of course to lower prices). Second suggestion they had was to fix my e-mails from ending up in their spam box. Yes I was sold ALL dirty ip’s which had all been blacklisted. Some major isp’s worked with me and allowed me in…(some)
Before I get flammed for choosing these guys, they truly were great up front so obviously I got fooled. I have no doubt they are great for some people but I simply can not drive my business into the ground because I went cheap and in the end got what I deserved. I moved to futurehost today and almost **** myself when a response ticket was answered in under a minute (kinda scary for a low priority ticket).
With this said, before you consider NewYorkNoc simply ask yourself if your business or site is important to you, if you can afford to lose business, and if you want constant downtime along with mysql corruptions daily. I am not saying they are the worst as they were helpful at first. Just EXPECT that when the deal is that good, you are being oversold. There is no other explanation in my books.
To sum this up:
Uptime: 3 out of 10 (there were up sometimes)
Customer Service: 2 out of 10 (would have given higher I did not have to repeatedly e-mail over the backend issues)
Price: 10 out of 10 (admit it, the price point these guys have is good)
Value: 1 out of 10 (I made a bad choice, I lost a ton of money in business and now have to work hard to recover my losses and rebuild relationships)
Recommend to others: 2 out of 10 (why 2? This place might be good for offsite backup maybe?)
This review is NOT out of spite due to my recent downtime. This review is merely my opinion and personal experiences and not written to bash NYNOC. If your happy with them then you are doing well. If you are considering them…….I urge you to think elsewhere. All my data is off the VPS and I am running before the backend crashes again corrupted my DB’s.
I'm interested in understanding more about how people who own data centers or rent out space at a data center (not just a rack) make their purchasing decisions for the environmental systems, power distribution, back-up generators, cabling, etc.
Does anyone know where I can
a) Talk to someone about this
b) Find out more information online
c) An industry association for data center managers
In PP12 all the add new domain buttons link to the Parallels shop page to purchase etchings like SSL certs, Domain Regitsrations, etc.
How do I tell PP to link to my WHMCS cart to order such things?
I am curious, what is the best way to ban certain IP from accessing server? I have software firewall (APF) and there is, of course, /etc/hosts.deny.
Which is the most efficient? I've read that software firewall becomes unstable after so many entries. Does the same apply to /etc/hosts.deny file?
Or is there a better way altogether?
some Chinese forums hotlinking images from my site and I even delete those images they keep sending me huge amount of http requests to my hosting server and eating 800mb of memory and upto 1GB cause server crash
I tried to block incoming referrer traffic from those sites using htaccess but it didn't work , I still see their http request on my server logs and memory keep goes high , am not sure my code is the right
how can I block these http request from these domains , what is the right htaccess code , I use DirectAdmin panel by the way
Can any one let me know how to block a range IP on SSH?
Eg: i'd like to block all IP: 67.63.123.xxx
I'm currently experiencing a lot of IP's starting with 200 and 201 (from Brazil) some IP’s have over 200 connections. I have APF installed and want to know how to block a block on ip's if this is possible.
IPS:
200.11.*******
201.*******
I have DDos Attack right now so I want to block all the IP from all over the world and just allow certain IP range.
How to do it using APF or any other way.
For example I want to block everything but Germany IP
Code:
53.0.0.0/8
62.4.64.0/19
62.8.32.0/19
62.8.128.0/17
62.24.0.0/19
62.26.0.0/15
62.40.0.0/19
62.44.32.0/19
62.48.64.0/19
62.50.32.0/19
62.50.96.0/19
62.50.192.0/18
62.52.0.0/14
62.61.32.0/19
62.68.0.0/19
62.72.0.0/18
62.72.64.0/19
62.75.128.0/17
62.78.64.0/20
62.80.0.0/18
62.80.96.0/19
62.89.160.0/19
62.91.0.0/16
62.93.192.0/18
62.95.128.0/18
62.104.0.0/16
62.109.64.0/18
62.109.128.0/19
62.111.0.0/17
62.112.32.0/19
62.112.64.0/19
62.112.128.0/19
62.116.128.0/18
62.117.0.0/19
62.128.0.0/19
62.128.160.0/19
62.133.0.0/19
62.138.0.0/16
62.141.32.0/19
62.141.160.0/19
62.145.0.0/19
62.143.0.0/16
62.144.0.0/16
62.146.0.0/16
62.152.0.0/19
62.152.160.0/19
62.153.0.0/16
62.154.0.0/15
62.156.0.0/14
62.165.0.0/19
62.168.192.0/19
62.169.0.0/19
62.176.128.0/19
how can i block to access to some IP?
for examaple scripts in my hosts can not access to some IPs i want
Fortigate appliances blocking an IP that is not in RBLs I have a problem with the IP 66.187.108.157 of my VPS it seems to be blocked by Fortigate appliances, as you can see in this error message:
SMTP error from remote mail server after RCPT TO:[url] host mail.am.com.pe [200.62.221.107]: 554 5.7.1 This message has been
blocked because it is from a FortiGuard - AntiSpam black IP address.(connection black ip 66.187.108.157)
However I have searched in this URL [url]and it is clean.
Any ideas on how to have/force Fortigate databases to become updated.
I'm having difficulties with a whm running on centos dedicated server. The problem is that we receive too much of spam and junk emails. by too much I mean 2000 bulks per week. It's killing us.
how I can stop it.
IM about tired of spam and hackers putting phishing items on my server.
My question is.
How can I block the whole world expect for US, CA and UK?
I've added several countrys to csf's csf.deny list but half of them keep disappearing.
Is there any way to block a particular ISP? Have a visitor that changes IP hourly, but the IP always resolves back to a hostname like dsl.yuns.sksk.uk .
I have CSF installed. Any way to block all visitors from dsl.yuns.sksk.uk?
in one of my servers i have this line in my ConfigServer Security & Firewall:
190.28.118.155 # lfd: 10 (suhosin) login failures from 190.28.118.155 - Mon Jun 16 23:27:50 2008
is this ok? i mean... its an attack of some sort? i know suhosin is meant to increase php security, so its blocking an attack right?
I have blocked this IP 125.115.144.28
/etc/apf/apf -d 125.115.144.28
But
netstat -anp|grep tcp|awk '{print $5}'| cut -d : -f1 | sort | uniq -c | sort -n
It still showing
202 125.115.144.28
Why?
Is it supposed to blocked right away, or need some time to get blocked.
When I checked /etc/apf/deny_hosts.rules
The IP is in the file.
I set up a forum for a small group of users, so I don't really wish to see spiders or bots on it, so I've put a robots.txt file there to prevent all of them from accessing the forum pages.
I know not all bots follow the robots.txt rule, and these days a really annoying bot called MUNAXNET or Munax AB with IP range 82.99.30.0 - 82.99.30.127 is causing the forum to have extra and unexpected loads.
I've tried to block this IP range with .htaccess and uploaded it to the root of the site a few days ago, here is the content:
<Limit GET HEAD POST>
order allow,deny
deny from 82.99.30.0-82.99.30.127
allow from all
</LIMIT>
However strangely it seems that all of these are not working for this bot, today I saw my forum had 80 users online and that army still keeps coming and browsing all pages of my forums...
I tested the .htaccess with blocking myself, and it actually worked for me, dunno why it's not working for that bot..
I was just researching my log analyzers to see whats happening... I noticed something new in the logs, a large number of unnamed robots or spiders... so I found the robot... it was this:
23310 7.99% 23303 9.48% 1159765 18.56% 22 0.12% 77.88.26.26
After some reading, sites say the ip belongs to spider26.yandex.ru
For simply security reasons, would it be in best interest to block the entire subnet? It seems that the same IP ending in .25 belongs to spider25.yandex.ru
Is anyone using snort?
Does it really block any web based attacks?
I know I can do port scans, and it can alert you to a whole bunch of false positvies, but is it blocking/detecting any serious attacks on your web server?
If so, which rules are the one is alerting on?
I have a Juniper firewall. I'm seeing a ton of traffic from the Twiceler bot in the range of 100,000 hits a day. Luckily they've more recently put up a list of IP addresses their bots use at:
[url]
So, I'm blocking all of these now. However I think it's a simple Netmask issue I'm having. I'm blocking all ports from
208.36.144.0/24
38.99.13.0/24
38.99.44.0/24
64.1.215.0/24
However, I am still seeing the bot in server log files. Could it be that I should not be specifying .0 at the end, but instead .1? Like this in the policy?
64.1.215.1/24
I have spamassassin configured its working 90% but still I am receiving mails from my ID only. Like I have info@domain.com so I am receiving mail from info@domain.com to info@domain.com.
View 7 Replies View RelatedHow do I block known proxy sites such as anonymouse.org or such via CSF (firewall)? I'll need to block by domains, wildcard domains (such as *proxy.tld) and IP's.
What is the proper way and is there a nice list of such proxies? I'm trying to prevent some degenerate troll from accessing my forum.
Since yesterday I have noticed some odd activity at one of my websites - www.cartuningcentral.com
The problem is that I am getting huge traffic from what I would say are traffic exchange programs, which I didn't buy, and don't want to have at all.
Examples of the referrals I am getting are:
[url]
[url]
Full details can be found here:
[url]
Now, I have tried to block all those using .htaccess, but I am by no means an expert on that.
Here's what I have done:
RewriteEngine on
# Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} ^(http://)?67.192.42.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} (tserve) [NC,OR]
RewriteCond %{HTTP_REFERER} (trafficserver) [NC,OR]
RewriteCond %{HTTP_REFERER} (67.192.42.2) [NC,OR]
RewriteCond %{HTTP_REFERER} (67.192.42.5) [NC]
RewriteRule .* - [F]
But it's not working at all.
how to block those referrals please?
It can be either using .htaccess, php, whatever.
I Have APF and BFD Installed but it always seems to show 80 odd events before blocking the IP. Is there a way of setting it to say 10 wrong attempts?
I Tried this, but it hasn't done a thing. below happened after the change.
Quote:
REQ="/usr/sbin/sshd"
if [ -f "$REQ" ]; then
LP="/var/log/secure"
TLOG_TF="sshd"
TRIG="10"
Quote:
Originally Posted by From BFD E-mail
The remote system 205.234.140.219 was found to have exceeded acceptable login failures on URL; there was 83 events to the service sshd. As such the attacking host has been banned from further accessing this system. For the integrity of your host you should investigate this event as soon as possible.
Executed ban command:
/etc/apf/apf -d 205.234.140.219 {bfd.sshd}
The following are event logs from 205.234.140.219 on service sshd (all time stamps are GMT -0600):
Feb 12 09:08:32 serverthree sshd[4552]: Failed password for invalid user test from ::ffff:205.234.140.219 port 35549 ssh2 Feb 12 09:08:32 serverthree sshd[4552]: Received disconnect from ::ffff:205.234.140.219: 11: Bye Bye Feb 12 03:08:33 serverthree sshd[4555]: Invalid user test from ::ffff:205.234.140.219 Feb 12 03:08:35 serverthree sshd[4553]: Failed password for invalid user test from ::ffff:205.234.140.219 port 35745 ssh2 Feb 12 09:08:35 serverthree sshd[4554]: Failed password for invalid user test from ::ffff:205.234.140.219 port 35745 ssh2 Feb 12 09:08:35 serverthree sshd[4554]: Received disconnect from ::ffff:205.234.140.219: 11: Bye Bye Feb 12 03:08:35 serverthree sshd[4557]: Invalid user test from ::ffff:205.234.140.219 Feb 12 03:08:35 serverthree sshd[4555]: Failed password for invalid user test from ::ffff:205.234.140.219 port 35794 ssh2 Feb 12 09:08:35 serverthree sshd[4556]: Failed password for invalid user test from ::ffff:205.234.140.219 port 35794 ssh2 Feb 12 09:08:35 serverthree sshd[4556]: Received disconnect from ::ffff:205.234.140.219: 11: Bye Bye Feb 12 03:08:36 serverthree sshd[4559]: Invalid user test from ::ffff:205.234.140.219 Feb 12 03:08:37 serverthree sshd[4557]: Failed password for invalid user test from ::ffff:205.234.140.219 port 35978 ssh2 Feb 12 09:08:37 serverthree sshd[4558]: Failed password for invalid user test from ::ffff:205.234.140.219 port 35978 ssh2 Feb 12 09:08:37 serverthree sshd[4558]: Received disconnect from ::ffff:205.234.140.219: 11: Bye Bye Feb 12 03:08:38 serverthree sshd[4561]: Invalid user test from ::ffff:205.234.140.219 Feb 12 03:08:38 serverthree sshd[4559]: Failed password for invalid user test from ::ffff:205.234.140.219 port 36033 ssh2 Feb 12 09:08:38 serverthree sshd[4560]:
[snipped irrelevant and lengthy log file - gbjbaanb]
Failed password for invalid user testing from ::ffff:205.234.140.219 port 42990 ssh2 Feb 12 09:10:00 serverthree sshd[4679]: Received disconnect from ::ffff:205.234.140.219: 11: Bye Bye Feb 12 03:10:01 serverthree sshd[4682]: Invalid user testing from ::ffff:205.234.140.219 Feb 12 03:10:02 serverthree sshd[4680]: Failed password for invalid user testing from ::ffff:205.234.140.219 port 43145 ssh2 Feb 12 09:10:02 serverthree sshd[4681]: Failed password for invalid user testing from ::ffff:205.234.140.219 port 43145 ssh2 Feb 12 09:10:02 serverthree sshd[4681]: Received disconnect from ::ffff:205.234.140.219: 11: Bye Bye
----
I am seeing quite a few hacking attempts coming from the TOR network. I'd like to block the TOR network on the firewall level. Anyone know how to block them?
There is a python script, but I am not familiar with Python at all and do not know how run this script. It is supposed to extract all current IP Addresses and provide a list.
I think they have about 450 IP addresses and I would like to block them.
I currently have a private server in my office which has cPanel and APF installed. The server only allows one static IP to access SSH, at the moment I'm away and don’t have a static IP on my current ISP connection so cannot access SSH.
Is there a way to add say 123.456.000.000 which would allow all IP's in the 123.456 block?