Server Attack Causing Problems For Three Days
Jun 18, 2008
Ever since Monday morning, my site has had problems because the server at my host is under attack.
Most of Monday my site was down. Then Monday late afternoon, it came back...I thought. The forum is up and running, but the rest of the site, built on WordPress, is screwy.
Most of the plugins aren't working because of inability to connect with the database.
I can't log in to my cPanel at all and haven't been able to since Sunday.
This is the first time I've experienced anything like this, lasting this long.
It has me wondering if I should start considering a new host. I have loved their service, especially their speedy support (native English speaking to boot) so I hate to leave but I'm not sure if their service is going a little downhill or not.
View 8 Replies
ADVERTISEMENT
May 24, 2008
Some jerk has been attacking my Windows based server for 2 days. Basically he said he has 600+ bots that connect and look like normal users. The site has been down and we have lost some serious income.
I was thinking about just using GigeServers ProxyShield as I thought it would be the easiest route but the $1000 a month is a bit much.
View 4 Replies
View Related
Nov 28, 2008
Virpus = Ticket 11 days old, started working on issue 6 days ago, no word for 4 days!
Thats Virpuss customer service and its plain silly.
View 11 Replies
View Related
Oct 24, 2009
i have wrong procedure doing to enable my SSL/HTTPS services in my vps.
First i noticed the HTTPS in my services is not running, now i'm looking to google, i found openssl website, then download the latest version and install it into my server and following the instructions, after that, i try to recompile the apache becuase i have a new updates, i found an error ssl and cannot continue to compile because of my last installation i suspect.
View 10 Replies
View Related
Jul 28, 2008
I just installed a fresh new server with CSF
Soon I find out that my ping keeps dropping. The server was smoothly running, SSH is smooth, Website are loading fine, except I cannot ping my server. I disable SELINUX completely and it still doesn't help.
When I disable CSF, my server ping are responding back!
So I remove CSF installation and reinstall CSF, the same problem appear
How can I solve this issue?
My kernel is 2.6.18-92.1.6.el5PAE running on latest version of cPanel on CentOS 5.1
View 7 Replies
View Related
May 9, 2007
I'm having a very intermittent PHP error on my dual processor CPanel/CentOS 4x box. And it happens randomly across several domains, so I know it's not a single domain problem.
I can never figure out what causes it. 95% of the time the sites work fine (no error), but ever so often my php includes give me something like this:
PHP randomly fails to find the directory/file. And it requires an Apache restart to make it work smoothly again. It will be fine for a few days, but then it happens again. So I suppose it may not be directly related to PHP, but more of a server/apache issue? Any ideas at all?
View 0 Replies
View Related
May 18, 2007
Which command do we type to see what is causing a high server load?
I've restarted the VPS numerous of times, and I wish to found out the problem
View 7 Replies
View Related
Jun 21, 2009
For the past few days, one of the server is causing a bandwidth utilization surge for the entire rack on almost daily basis. It happen for a few minutes and it went off then it will be the same thing again the next day. When the surge is happening, most of the servers on the same segment will be inaccessible for the few minutes.
The bandwidth utilization graph for my rack is recording an abnormal surge from (6mbps --> 90mbps) for the few minutes. My MRTG is showing 2 of the Plesk servers giving the problem but the NOC guys said it the Cpanel that causing the problem.
I tried logging in to both servers but could not find what's the cause for this.
View 2 Replies
View Related
Jul 17, 2008
It's been a while since I've posted in this area of the forum, but was just wondering if by now someone or some company has developed a script/software that you can install on your server that will tell you the exact area where the high CPU load is coming from, such as from someone sending email, a certain users account, and etc?
Most times, you have to be mointoring your server at the time of the high load to be exactly sure of what is causing the high load, so, I'm talking about something that will email you right on the spot of the high load in case you are away and will know what caused it.
Most I've seen only tell you that you have a high load, but don't tell you what exactly caused it.
View 2 Replies
View Related
Dec 14, 2007
My host has suspended saying my server was overloaded and sent me a log to my mail and i don't have access to cpanel also. I just have a wordpress blog and when i had contacted host through chat they told some ip might be causing this issue so ban that ip when ur account is unsuspended.
But i am really unaware of how to find which ip is causing this issue as i have little knowledge on analysing logs. Any help regarding this is highly appreciated and please leave your suggestions for me.
I am pasting the logs that were sent by host to me in mail:
Srv PID Acc M CPU SS Req Conn Child Slot Host VHost Request
0-5 22363 32/49/49 K 5.76 2 1695 583.9 0.82 0.82 76.227.169.69
GET /index.php/181/ HTTP/1.1
1-5 22365 81/81/81 W 42.69 3 0 3060.8 2.99 2.99 76.183.97.67
GET /index.php/181/ HTTP/1.1
2-5 22367 87/87/87 K 45.81 2 991 3287.3 3.21 3.21 76.183.97.67
GET /index.php/181/ HTTP/1.1
3-5 22369 2/41/41 K 2.07 8 0 15.3 0.12 0.12 67.87.117.129
GET /wp-content/plugins/postratings/images/stars/rating_half.gi
6-5 22387 0/13/13 W 2.21 57 0 0.0 0.12 0.12 81.22.20.143
GET /index.php/181/ HTTP/1.1
7-5 22388 76/76/76 W 39.94 0 0 2871.9 2.80 2.80 141.153.137.168
GET /index.php/181/ HTTP/1.1
8-5 22396 0/26/26 W 2.46 38 0 0.0 0.34 0.34 127.0.0.1
care.com GET /whm-server-status HTTP/1.0
13-5 22413 0/18/18 W 1.46 44 0 0.0 0.33 0.33 81.22.20.143
GET /index.php/181/ HTTP/1.1
14-5 22414 0/25/25 _ 0.76 55 672 0.0 0.28 0.28 71.77.3.233
GET /wp-content/uploads/2007/12/cup.jpg HTTP/1.1
20-5 22464 2/14/14 K 0.66 8 0 52.5 0.14 0.14 67.87.117.129
GET /wp-content/plugins/postratings/images/loading.gif HTTP/1.1
21-5 22484 0/6/6 _ 1.31 40 329 0.0 0.03 0.03 74.77.10.155
-care.com GET /~realrina/nun.jpg HTTP/1.1
22-5 22510 27/37/37 K 18.07 0 1832 982.5 1.25 1.25 80.195.137.10
GET /index.php/181/ HTTP/1.1
23-5 22523 8/34/34 K 1.76 8 0 94.6 0.30 0.30 67.87.117.129
GET /wp-content/plugins/postratings/images/stars/rating_on.gif
27-5 22540 0/10/10 _ 3.36 39 167 0.0 0.19 0.19 90.192.174.63
GET /wp-content/uploads/2007/10/anand.jpg HTTP/1.1
28-5 22542 1/14/14 K 1.76 8 823 151.9 0.23 0.23 67.87.117.129
GET /wp-content/themes/ProSense%20Redux/images/picture.jpg
HTTP
29-5 23481 0/6/14 _ 0.37 11 2803 0.0 0.11 0.12 82.37.128.175
radio.audio-perfection.co.uk GET /img/player.png HTTP/1.1
30-5 22584 32/44/44 K 15.47 0 1284 989.6 1.06 1.06 80.195.137.10
GET /index.php/181/ HTTP/1.1
31-5 22588 22/25/25 K 5.77 0 751 468.0 0.46 0.46 76.227.169.69
GET /index.php/181/ HTTP/1.1
32-5 23520 0/5/8 _ 0.20 19 414 0.0 0.05 0.09 72.95.237.89 pown.us
GET /images/files/36.jpg HTTP/1.1
33-5 23627 1/6/22 K 0.06 3 967 28.0 0.06 0.35 66.249.65.196
GET /index.php/category/telugu-online-movies/page/4/
HTTP/1.1
36-5 23637 2/3/6 K 0.00 3 37 0.0 0.000 0.03 83.181.190.92 akirad.net
GET /files/color/garland-9bf1a50e/menu-expanded.gif HTTP/1.1
37-5 23673 8/9/16 K 0.49 8 0 126.9 0.20 0.21 67.87.117.129
GET /wp-content/uploads/2007/12/movie_dus_kahaniyaan.jpg HTTP/1
38-5 23674 1/3/10 K 0.00 11 1536 23.0 0.06 0.15 84.57.59.109
teeth-whitening-kit.com GET /affiliate/scripts/sb.php?a_aid=17&a_bid=7
HTTP/1.1
39-5 23690 10/10/22 K 0.99 3 0 35.6 0.03 0.29 83.181.190.92
akirad.net GET /files/color/garland-9bf1a50e/bg-tab.png HTTP/1.1
40-5 23693 0/5/10 _ 0.00 44 1106 0.0 0.04 0.07 67.11.157.83
teeth-whitening-kit.com GET /affiliate/scripts/sb
44-5 23721 1/3/6 K 0.00 8 0 0.4 0.000 0.00 67.87.117.129
GET /wp-content/plugins/share-this/share-icon-16x16.gif HTTP/1.
45-5 - 0/0/3 . 0.00 39 1 0.0 0.00 0.00 83.181.190.92 akirad.net GET
/files/color/garland-9bf1a50e/menu-expanded.gif HTTP/1.1
46-5 - 0/0/5 . 0.22 22 1332 0.0 0.00 0.04 81.22.20.143
GET /index.php/181/ HTTP/1.1
47-5 22780 51/52/52 K 26.66 0 940 1927.2 1.88 1.88 76.183.97.67
GET /index.php/181/ HTTP/1.1
48-5 - 0/0/3 . 0.00 37 6786 0.0 0.00 0.02 81.22.20.143
GET /index.php/181/ HTTP/1.1
51-5 - 0/0/13 . 0.26 35 34109 0.0 0.00 0.06 71.77.3.233
GET /favicon.ico HTTP/1.1
54-5 23746 2/3/3 K 0.51 3 0 0.0 0.02 0.02 83.181.190.92 akirad.net
GET /files/color/garland-9bf1a50e/menu-leaf.gif HTTP/1.1
55-5 23747 0/0/0 W 0.00 20 706795599 0.0 0.00 0.00 81.22.20.143
GET /index.php/181/ HTTP/1.1
56-5 - 0/0/3 . 0.00 16 4868 0.0 0.00 0.00 66.7.206.192
care.com GET /serverstats_inc.php HTTP/1.0
57-5 - 0/0/5 . 0.09 44 0 0.0 0.00 0.01 195.13.38.198 (unavailable)
POST /users_adm/start1.php HTTP/1.1
58-5 - 0/0/1 . 0.00 24 1640 0.0 0.00 0.02 81.22.20.143
GET /index.php/181/ HTTP/1.1
61-5 - 0/0/2 . 0.07 12 10194 0.0 0.00 0.01 172.188.47.93
radio.audio-perfection.co.uk GET /play_wmp.php HTTP/1.1
View 5 Replies
View Related
Apr 5, 2008
I guess you can fugure my account expired with servage.
but to tell you the truth, I am so P OFF at them
I opened a ticket on my last day and asked if I can move it from 14 months (that I started with) to a 6 months renewal because I could'nt afford to pay the £74 they wanted, and apologised for this. They said I'd have to pay the 74 pounds first and then change my billing to 3 or 6 months.....
I replied saying can I then pay a sum now and a some next week. as I don't have that with me at the moment but wednesday 9th April I wil be able to remew it all
They replied with:
"Hello Ahmed
there is 14 days grace period for customers before account gets suspended."
So I thanked them very much, because like that, instead of paying in installments, I can just pay them the whole amount before the grace period was over, otherwise I would've backed up my data and moved it another server, or on my computer till I remew the whole amount....
5 days later (today), I log on to my account, and it has been suspended as I hav'nt paid for 5 days...thats 9 days before the "grace period"
and now all my domains have this dirty suspended page that they have, and I bet I lost half my members and customers like this, as when I see this page on any domain I enter I never go back to it!
I say to my self its my falt, I should've paid when I had to.....but money was tight, and I told them....and they gave me the 14 days, I did'nt ask for anything, but I thought backing up all my sites and my webdriver that I have with them would take me ages, plus the pages have alot of content that would be a hassle, if I have a "14 days grace period".
This is the first time servage have lied to my face, and not by answering a question with yes or no, by saying a feature they have that does'nt exist and but wednesday I bet all my customers and members would've found somewhere else to hang out, as I only contacted them through the mail server on the site and my forum, now I can't even right "we will be back soon....don't go away",
I thought I warn you guys about this grace, if you have an account with them make sure your ready to renew before it expires, and don't believe most of the stuff that they say.
OMG, I used to promote for these people, and tried hard to always say good stuff about them, you see my sig, it was a promotion for them with a coupon code (that I dredfully apologies about to the administration for not reading the rules properly), and I get in return a lie straight in my face with no warning and no way of accessing my database what so ever.
Just be warned Guys, don't believe everything they say to you and backup all the time because you never know why they suspend your account.....even if your on thew right track
View 6 Replies
View Related
Apr 20, 2008
One of my servers at FDC Servers is crashing (= kernel panic) every few days since we got it.
The specs of the machine are:
C2D E6550, 2 GB
Linux .. 2.6.24.4-64.fc8 #1 SMP Sat Mar 29 09:15:49 EDT 2008 x86_64 x86_64 x86_64 GNU/Linux
I opened several tickets with FDC, after running memtest and clocking down memory they say it's not a hardware issue but software related.
Quote:
I see that according to this ticket, memtest has been run without error and the memory was even slightly clocked down to avoid problems. It appears that the errors you are reporting are software related...
I already tried several kernels and different application versions.
The server is only running lighttpd.
View 12 Replies
View Related
Aug 11, 2008
some customers contact with me and told me that since 2-3 last days, they can't reach sites wich are hosted on my server(for a liitle time) for example 2 hours and then again after 5hours for 10 minutes and etc.first i thought that was problem with their isp but i dont think so because we use the same isp with some of them(customers) and me and other friends of me we reached the same sites at the same time when the others(customers) can't. do you think its something with the apache in my server?blocks some users? some ideas that maybe has to do with the problem i mention?i think that is sommething with the apache.any ideas white might be?
operating system centos
View 3 Replies
View Related
Jul 30, 2008
My server with Servstra has been unreachable for 3 days now. The only replies I get from support is "have patience". I wish they would tell that to all my customers that are leaving. They have not even given me a full explanation of what is happening. They do not provide a phone # for me to call either, so I am at their mercy now. Guess it's time to start looking for a new job cause my hosting business is gonna be gone after this.
View 4 Replies
View Related
Oct 30, 2008
I've not posted feedback for past providers that haven't been so good, but due to bad service and a lack of refund after nearly 2 weeks, I really need to post my situation.
The site is pc-core.net, and they have had some fairly decent offers going on WHT.
After 5 days of good service from the dedicated provider PC Core, I ran into possibly the worst 10 days of running a website I’ve ever encountered and a further 12 days without a refund.
Here’s my story.
I signed up for a dedicated host in September, and my machine was made active on 25/09.
The server went down 5 days later on 30/09, and it took more than 24 hours to get it back up. So now we’re running on late 01 Oct 2008, but slow and sometimes unresponsive. The site then goes down completely on 05 Oct 2008. A response on 06 Oct 2008 saying they’re looking into the situation. Had to then wait 2 days, and post 3 replies to get a response on 08 Oct 2008.
One last response on 09 Oct from support, then I had to update the ticket 10 times to get another reply on 14 Oct 2008.
The server was down for 9 days with little to no response from the tech support, despite me continually trying to contact them.
Server back online briefly, then down again on 15 Oct 2008.
On 16 Oct 2008 I placed a ticket applying for a refund, which should be instant and my account cancelled instantly. Refund request finally got through on the 18th, server down but my account on their site is still live (so I’m still being invoiced via PayPal).
Their refund policy:
If for any reason you are unhappy with our service, and wish to leave during the first 30-days, PC Core will refund your purchase price less applicable fees in full.
It’s now 30 Oct and as I write this I’m still waiting for a refund (12 days waiting for a refund, still no response), still waiting for my account to be cancelled and I’ve posted numerous tickets asking for an update during the last 12 days.
I was told that they may pay me for the remaining days I had left after cancelling.
Surely a full refund is in order? Or at least the downtime and remaining time for the month.
I’ve been with 4,5 dedicated providers in the last two, three years but I have never seen any take more than 5 days to respond to server downtime, it’s appauling. The only thing going for the provider during my month with PC Core was that the staff were kind and helpful when they were around to give it.
View 14 Replies
View Related
Apr 3, 2007
I migrated my server on friday, and I changed the IP address of my DNS. There are still a few customers accessing the old server. What can I do? Is it possible to flush some persistent DNS cache somewhere?
View 9 Replies
View Related
Oct 10, 2012
- Apache version : 2.2.21
- operating system : MAC OS Lion Server
- mod_ssl : 2.2.21
I have a certain area on a homepage which is protected by an .htaccess file. The code of the .htaccess file is the following:
Code:
AuthType Digest
AuthName "Password Required"
Options +Indexes
# code for HTTPS
RewriteEngine On
RewriteCond
%{SERVER_PORT} !^443$
RewriteRule (.*) https://%{SERVER_NAME}%{REQUEST_URI}
Require valid-user
Usually everything has been working fine with this .htaccess-file until today. There hasn't been any change on the system.
If you click on the hyperlink to the restricted area the login window appears where you need to type in your username and a password. After typing in these data the following message appears in the browser:
500 Internal Server Error
The server encountered an internal error or
misconfigruation and was unable to complete your request. (…)
The apache error log file contains the following message:
Request exceeded the limit of 10 sub request nesting levels due to probable configuration error.
Use 'LimitInternalRecursion' to increase the limit if necessary.
Use 'LogLevel debug' to get a backtrace.
The increase of the LimitInternalRecursion does not solve the problem. So I switched the LogLevel in the httpd.conf file from warn to debug and looked again on the entries of the error log.
The following appeared (I have replaced ip addresses, usernames and URL by xyz or <URL>) :
Code:
[error] [client xyz]
mod_digest_apple: Client is using a nonce not issued by this server for this context:/rb/Vorlesung/WS12/Downloads/, referer:
http:<URL>
[Code] ....
View 3 Replies
View Related
Mar 12, 2008
I paid for a server with GeekRack.net 8 days ago, and have seen no sign of the server being setup.
Now I know they are just a Burst.net reseller, they don't own or order the hardware or even have physical access to the servers, they simply get 25% off Burst.net and just resell their servers. That said you'd expect at least some sort of notification on when the server would be ready by, especially by now, right?
View 14 Replies
View Related
Jul 2, 2009
My server is currently underattack, I have been able to keep it up but after I ban 500 IPs, I get a lot of different IPs again.
Any idea or suggestion to do mass-ban to those attacking IPs?
tcp 0 0 xxx.xx.xxx.xxx:80 190.87.128.59:3965 SYN_RECV
tcp 0 0 xxx.xx.xxx.xxx:80 82.115.52.10:2323 SYN_RECV
tcp 0 0 xxx.xx.xxx.xxx:80 90.148.137.56:21094 SYN_RECV
tcp 0 0 xxx.xx.xxx.xxx:80 189.237.35.155:57605 ...
View 14 Replies
View Related
Jul 6, 2009
Now I'm looking at our last cpu_exceeded_logs file and there is long list point to "/ramdisk/bin/php5" which I don't know much about it or don't know how to deal with that. would you please tell what exactly it means and what should I do to avoid it?
Example of my last cpu_exceeded_logs file:
Quote:
Mon Jul 6 00:34:50 2009: used 0.77 seconds of cpu time for /ramdisk/bin/php5
Mon Jul 6 00:34:50 2009: used 0.50 seconds of cpu time for /ramdisk/bin/php5
Mon Jul 6 00:34:50 2009: used 0.80 seconds of cpu time for /ramdisk/bin/php5
Mon Jul 6 00:34:50 2009: used 0.55 seconds of cpu time for /ramdisk/bin/php5
I can't find the cause of problem when look at /ramdisk/bin/php5.
View 5 Replies
View Related
Jun 29, 2008
Can someone figure out by the screenshot, if my CPU is really
97% iddle, and what can be causing these average load numbers?
View 14 Replies
View Related
Jul 4, 2006
Someone is trying to attack our server (I think so). When running apache status there are a LOT of connections from one network, all requesting the same page. But running: netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n does show any of these IP's. So script blocking ddos attacks wont work. Anyone know what can I do about this?
View 14 Replies
View Related
Aug 22, 2007
I went today to my apache error log, and noticed that those scum lowlifes hackers trying to hack my server every day for at least 100 times!!!
What a disaster!
Examples of urls they trying to use:
- http://usuarios.arnet.com.ar/larry123/safe.txt?
- http://uploaded.justfree.com/id.txt?
- http://nukedclx.info/php/base
Is there anything that can be done to prevent this mor*** from even trying to hack (except putting a bullet in his/their head)?
View 14 Replies
View Related
Nov 7, 2009
two of my website on the server was changed by the hackers.How did they do it?
View 7 Replies
View Related
Nov 3, 2009
i got botnet attack my web server...is there anything i can do to block thse attack? my host isnt help much?
View 4 Replies
View Related
Oct 22, 2009
how to protect an linux dedicated server from bot attack. Im using linux server with cPanel, using CSF firewall + DOS Deflate.
View 5 Replies
View Related
May 17, 2009
How can check server for dos/ddos/syn attack?
Because my server load is high, perfromance is low, but i dont have any high process.
View 5 Replies
View Related
Feb 2, 2008
is this DDOs attack : .....
View 5 Replies
View Related
Jan 31, 2008
I think I'm experiencing some type of alternative to a DDoS attack. My server is being killed by thousands of emails being sent to fake accounts on my server.
I'm not a server administrator, so please bear with me.
My load average is skyrocking to 800.xx at times. I look at "top" and see "exim" for one specific user on my server. I own all the websites on my server, by the way.
When I look at my email queue, I see thousands of emails coming in to accounts that don't exist for that specific user. Let's say the domain name is salcollaziano.com. Somebody is sending spam to various salcollaziano.com aliases that don't exist. Like webmaster -at- salcollaziano.com and suzy -at- salcollaziano.com.
How can I prevent these spam emails from having any interaction with my server? It's causing me a lot of downtime on all the sites I have running on that particular server.
View 14 Replies
View Related
Nov 27, 2008
Not sure if it's a valid threat, but I would like to do the best I can to identify one as early as possible.
Can someone maybe give me an idea of what to look for? They were not specific on there type of attack, but I was hoping that there was maybe a log file I could tail and keep an eye out for irregularities.
View 10 Replies
View Related
