Site Getting Attacked At Will

Oct 11, 2007

My site is getting attacked since last couple of days and the attacker brings it down in 5-10 minutes.I have to restart the apache webserver to bring it back again until he strike again.

I am trying to secure it as much as possible using .htaccess,i am able to stop almost all the perl/php scripts etc but the last time the hacker attacked the site today,i see 100s of these entries in my logs:

Code:
71.181.220.147 - - [10/Oct/2007:21:44:44 -0700] "GET /templates/template/images/content.png HTTP/1.1" 200 510 [url] "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Embedded Web Browser from: [url] .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0; IEMB3; .NET CLR 2.0.50727; IEMB3)"

I would like to know what is this "Embedded Web Browser from: [url] and how can i block the hacker from running this using .htaccess?

View 10 Replies


ADVERTISEMENT

Site Being Attacked Hard

Jul 27, 2008

I'm Tech admin at Fagex.net

This site has always been prone for attacks on it's servers. At the moment theres been a new owner and so things are not settled back down yet, How ever people are still atacking the site.

The hosting as far as i am aware has no software/hardware firewall i have tould the onwer but has not taken my advice.

This morning i woke up to find it was being attacked, so i went stright to SSH and started blocking them etc.

I was looking around for free Anti DOs tools and came across,

[url]

Seems good, I've only just installed so still need to see the effects.

I also added a block in to htacess which has

Quote:

<ifmodule mod_limitipconn.c>
<cocation />
Maxconnperip 3
NoIPlimit image/*
</location>
</ifmodule>

The server is a dedicated VPS, and the owner has two sites on which both are forums.

What can i do to protect the sites? What can i do to prevent them? What can i do to stop them.

View 12 Replies View Related

Being Attacked What Can I Do

May 28, 2008

From running smoothly to suddenly going to 900 write requests, my web server crashes.

I don't want to be asking the DC to restart my machine every minute.

They installed Squid which solved the load and seems to run smooth. But my script doesn't function properly as everything is cached.

I then put all my images/css etc on a lighttpd server which can handle all the requests without problems.

So now apache is only handling around 30 php requests per second. But will magically jump up to 600+.

The DC says I'm being syn flooded.

I have APF, deflate DDoS, etc. installed.

Anything else I can do?

View 6 Replies View Related

Being Attacked - DDOS?

Nov 6, 2007

OK well today I found out my server was being DDOS'ed

And I know which domain is being attacked with hundreds of IP's. I am running Cpanel / WHM but I have no idea how I can stop this?

Any ideas or suggestions? Maybe redirect the DNS? to a invalid ip? But I'm not sure how i can go about doing that?

View 9 Replies View Related

Server Is Being Attacked

Jul 1, 2009

Server info:

Windows 2003 box

Dedicated server currently hosted at the planet.

Problem:

It would appear there has been a security breach into the server recently. This morning we cleared off a Trojan, and also a new user that had been created on the server.

All of our websites we host (around 200) had been affected. Almost every file had new javascript or links to an .swf, they load in iframes and are very malicious, actually giving any vistor to the site a virus.

I tracked down the embed code that I found in most files appended to the end of each file.

Below shows up in most .asp, .cfm, .html files (no spaces, just can't paste a url in here yet)...

<scRipT s rc=[url]
<scRipT sr c=[url]

Below shows up any any .js file (no spaces, just can't paste a url in here yet)...

document.writeln ("<script sr c="[url]
document.writeln ("<script sr c="[url]

So I got a script that opens up every file looking for this code and stripping it out. Seemed to work at first, but now all the sites have been rewritten again..... and again. So obviously something is overwriting this.

View 9 Replies View Related

Web Server Has Been Attacked

Jul 1, 2009

Server info:
Windows 2003 box
Dedicated server currently hosted at the planet.

Problem:

It would appear there has been a security breach into the server recently. This morning we cleared off a Trojan, and also a new user that had been created on the server.

All of our websites we host (around 200) had been affected. Almost every file had new javascript or links to an .swf, they load in iframes and are very malicious, actually giving any vistor to the site a virus.

I tracked down the embed code that I found in most files appended to the end of each file.

Below shows up in most .asp, .cfm, .html files (no spaces, just can't paste a url in here yet)...

<scRipT s rc=[url]
<scRipT sr c=[url]
Below shows up any any .js file (no spaces, just can't paste a url in here yet)...

document.writeln ("<script sr c=[url]
document.writeln ("<script sr c=[url]

So I got a script that opens up every file looking for this code and stripping it out.

Seemed to work at first, but now all the sites have been rewritten again..... and again.

So obviously something is overwriting this.

View 7 Replies View Related

If 1 Website Were To Get Attacked

Jun 29, 2009

if i were to have 1 website get have a DDoS attack to it, would it knock out my server for a while, and can i recover the server by restarting it?

View 14 Replies View Related

Getting DDos Attacked

May 28, 2008

All my websites are down because a Dos attack on port 80. Rackspace basically said they can't do anything to help me unless I want them to install a $1500 a month hardware add on. They tried banning a couple ip addresses and that did not work. They recommended prolexic.com but does anyone have any other advice?

View 14 Replies View Related

Attacked By Russia

Jun 11, 2008

I have been consistently attacked by Russia.

When I had apache my server would die and you couldn't even SSH. Now I have Litespeed my site loads but SUPER SUPER slow.

Last night I was SYN Flooded with 125mbps. Though they consumed nearly all my bandwidth and I owe the DC tons of cash in bandwidth now. I managed to block Russia and the load halved to about 50 and the site was still functional but intermittent.

I have been running Deflate DDoS etc to block IPs.

I'm wondering if I get a load balancer with another box, would this fix my problems?

I heard you can modify the settings somewhere to identify syn attacks and auto block them.

View 3 Replies View Related

Server Is Being Attacked

Jun 20, 2007

222.216.28.147 - - [20/Jun/2007:06:05:04 -0500] "GET [url]
(compatible; MSIE 6.0; Windows NT 5.0)"
172.131.255.237 - - [20/Jun/2007:04:41:06 -0500] "POST [url]
172.131.255.237 - - [20/Jun/2007:04:41:07 -0500] "CONNECT mx1.mail.yahoo.com:25 HTTP/1.0" 405 303 "-" "-"

View 1 Replies View Related

Is My Server Being Attacked

Dec 25, 2008

Is my server being attacked? Please help.

Is my server being attacked? Please help.
I'm using Linux RedHat el5. Recently, my server down almost at the same time everyday.
I try looking in /var/log/messages, it is flooded by this kind of message:


Dec 25 22:41:16 ls1 xinetd[3958]: START: smtp pid=430 from=173.66.124.249
Dec 25 22:41:16 ls1 xinetd[3958]: START: smtp pid=437 from=92.84.45.130
Dec 25 22:41:16 ls1 xinetd[3958]: START: smtp pid=439 from=173.66.124.249
Dec 25 22:41:16 ls1 xinetd[3958]: START: smtp pid=440 from=173.66.124.249
Dec 25 22:41:24 ls1 kernel: ip_conntrack: table full, dropping packet.

From the log, at "from=xx.xx.xxx.xxx" are not all the same, but the same ip appeared for a while, then change to another.

I'm newbie to Linux, and donot quite understand what the this message is mean. Is this can be a cause that make my server down? Please suggest.

View 7 Replies View Related

I'm Being DOS Attacked By A Gameserver Company!

Dec 20, 2008

My internet connection started cutting out and I found it strange, I presumed it was with my ISP and so I ignored it as they're pretty crap, then it carried on today so I did some investigation (Turned on error logging for my router) so I go ahead and wait, an hour later my internet connection cuts out, to the logs!

Sat, 2008-12-20 22:01:38 - UDP Packet - Source:89.238.152.200,28960 Destination:192.168.1.103,28960 - [Firewall Log-DOS] ....

Am I correct in thinking there are multiple IP addresses "Attacking" my home network? If so, that's mighty strange and should I be worried?

I checked some of the IPs, most go to dedicateds around the world. One is a gameserver admin panel. Have these been hijacked and being used to "Attack" me?

I have a theory, be it probably wrong; The port number 28960 is used by Call of Duty 1 as the "default" port for a gameserver, and I play a lot of CoD1. Therefore, presumably, that port is open by our router, 28960, so somehow they've found this to be open and are "attacking" it. I'm not sure, but it seems possible, not sure why though.

192.168.1.103 is presumably ME on our subnet? Router is linksys

View 10 Replies View Related

Identify What Domain Is Being Attacked

Mar 20, 2008

Is there a way to determine from monitoring the packets coming in to my IP address what domain on my server is being attacked? Something like Tcpdump maybe can tell me? Having DDoS trouble and I'm trying to identify the domain being hit.

View 2 Replies View Related

Server Being Attacked Via Http

Jun 1, 2007

my friend's server is being attacked, the http processes shoots up causing the server load to go above 200 in minutes of starting httpd which causes server to die.

this is how the apache web server's access_log would log a normal http request;
------------------------------------------------------
"xx.xxx.xx.xx - - [01/Jun/2007:22:13:21] "GET /folder/name.gif HTTP/1.1" 200 877 [url]"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)"
------------------------------------------------------

Today when the http load increased we saw hundreds of following requests;
------------------------------------------------------
"xx.xxx.xx.xx - - [01/Jun/2007:22:13:21] "GET /? HTTP/1.1" 200 16305 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
------------------------------------------------------

You see the difference between a legitimate http access log entry and the above one is that the legitimate one shows the filename(GET /folder/name.gif) and domain name being requested whereas the second one shows ("GET /?")

Above requests continously originate from 30 to 40 different ip addresses. Most of them russian ips, and many form US and canada to.

When i do a grep "GET /?" in access log there are thousands of these which started just today.

I cannot block each ips because i feel they have hundreds of IPs to initiate these requests from.

View 14 Replies View Related

Server Is Being DDOS Attacked

Oct 22, 2007

I see what IPs are attacking them? OS: CentOS

View 9 Replies View Related

My Limestone Server - Virus Attacked Or What?

Jul 23, 2009

Alright guys - my server the past two weeks is just freaking ridiculous. It's a Core2Quad Q9300 2.5ghz server with 8gb of ram. It should be fast as hell. I can't move 20 e-mails in my mail client without the server grinding to a complete halt and httpd and mysql going unresponsive. Right now I'm just trying to copy a damned screen shot of the task manager performance tab and it's taking about 3 minutes to paste it - even though the CPU utilization is averaging only 20% at the moment and memory is only 2.5gb.


I restarted WAMP and now it seems to be running smoother. My Outpost firewall, though, didn't show too many connections to the server that it was maxing out.

Here's my ping responses just now while I was typing this - I was watching the firewall connections and I was only having like 60 connections to httpd, 20 connections to mysql, 5-10 to my SmarterTools mail server, and then my remote desktop connection. My network utilization got up to a whole 5% - so it's not that I have too many connections or something. Here's the ping responses:

C:Documents and SettingsBrian>ping mifbody.com -n 99

Pinging mifbody.com [216.245.195.146] with 32 bytes of data:

Reply from 216.245.195.146: bytes=32 time=70ms TTL=115
Reply from 216.245.195.146: bytes=32 time=73ms TTL=115
Reply from 216.245.195.146: bytes=32 time=81ms TTL=115
Reply from 216.245.195.146: bytes=32 time=78ms TTL=115
Reply from 216.245.195.146: bytes=32 time=71ms TTL=115 ....

View 7 Replies View Related

Port Scan Attacked On Users

Apr 14, 2007

[url]

[url]

One of my users posted this in the forum saying my server is scanning his computer. His this serious? Do I have virus? Should i be worried? Well i am kinda worried. I tried googling it, but i can't seem to figure the right keywords for a good result.

View 4 Replies View Related

Hacked - DDos Attacked, Downtime 1 Week...

Aug 23, 2008

The attack is large enough now that the rules I've put in place aren't really helping much. Mod_evasive and mod_security are also installed, however this doesn't appear to be helping much either. The invalid user-agents hitting the site are filling up the max connections and then apache stops responding. I also tried raising the MaxClients in httpd.conf, however the vps then started hitting its memory limit.

I was on a shared plan and they moved me to a VPS same problem
Host: urljet.com

I have had one host representative thats said "I think we could take care of you but you would have to use this plan with the firewalls"

www . liquidweb.com/cart/content/dedicated/Webmaster/Plan1

View 14 Replies View Related

Static Routes With Linux & Shorewall (site To Site VPN Virtual Private Network)

Mar 29, 2009

Attached is a (badly) drawn diagram of two sites, connected by a vpn.

The site to the left, is network 10.0.0.0/24 which runs a linux server as the router for the network.

The site to the right, is network 10.1.0.0/24 which runs a windows 2003 server as the router for the network.

Now, my problem is, the clients behind the windows 2003 server can ping any machine on the first network because i setup a static route to route all traffic to 10.0.0.0/24 over the vpn interface.

now, my problem is, only the linux server can ping any machine on the windows 2003 network, any client behind the linux server cant seem to route over the interface.

I have the following route on the linux server: .....

View 0 Replies View Related

Plesk Automation :: Adding Dedicated IP Breaks Site (visitors Land On Default Site)

Apr 14, 2015

Starting point: a working site using a shared IPv4, dedicated IPv6, and SSL. HTTP and HTTPS work, the latter only using SNI of course.

The good news: If I simply allocate an IP resource of 1 to a subscription it is pulled from the pool, assigned to the service node, assigned to the web site, DNS is updated, and the site is automatically changed to using a Dedicated IPv4 and Dedicated IPv6.

The bad news: visitors land on the default web site of the service node, with the default SSL certificate.

Other info: I can't ping the new IP, even though it shows in "ip a l" and /etc/sysconfig/network-scripts/ifcfg-eth0:0. [edited]

After the IP assignment, it is still installed, and /etc/httpd/conf/plesk.conf.d/ip_default/domainname.conf shows the new certificate is being used.

However, a second set of VirtualHost entries is created in server.conf for this IP for ports 80 and 443, with NameVirtualHost enabled on the new IP. The port 443 entry uses the default certificate. Apache's setup this default VirtualHost entry will override the web site configuration because Apache is listening on port 443 with the wrong cert.

If I go to "Change webspace settings" and toggle to Shared IPv4, Dedicated IPv6 the site works again via HTTPS, and Dedicated IPv4 and Dedicated IPv6 breaks it again. Setting the SSL cert to None and back again does not work.

Setting the SSL cert to None, changing to a dedicated IP, and enabling SSL results in the server being inexplicably inaccessible...browsers no longer connect to either the default site or the correct site, and I don't see any entries in the vhosts's logs.

View 6 Replies View Related

Is There Anyone Knows For A Good Hosting,which Is Allowed : Adult Site & Casino Site?

May 21, 2008

is there anyone knows for a good hosting located in uk,which is allowed : adult site and casino betting online site ?

im looking for vps and dedicated server.

please help me i really need as soon as possible.thx

View 2 Replies View Related

How Effective Can Be Lighttpd 4 My Site ( Forum + Filesharing Site )

Jun 16, 2008

I run basicly run two main site.

1.Forum big one .

2.File and image sharing site.

(image sharing site generates thumbnails which produces lots of hits)

In these conditions how much difference can lighttpd can do as compared to apache for keeping my 600 MB Ram VPS host constant.

View 5 Replies View Related

Database Site Vs Comany Site

Jun 29, 2009

I'm on a short assignment to inventory and manage the fixed assets of a small company, and we've just bought a web-based database for this purpose. While I'm pretty good at administering/running local databases, the web part has me stymied. Our company is between IT people, and there's no one on site with any more idea than I have about what's going on!!

Here's what I have so far:

--The company has a website which I'll call "ourwebsite.org" -- which I think, from searching the IP address the website points to, is hosted by HostMySite.com.

--There's also a record in DNS Management with the same name (ourwebsite.org), but pointing to our little server's local IP address.

--I need to find a way to get my database -- which I can access on the network at (server's IP address)/database (ie 0.0.00.0/database) -- online. I tried creating records in DNS Management (for ex., assets.ourwebsite.org) that point to our server's IP (the one that, if I type it in on the network, I can get to the site I'm looking for), but get generic "can't find the page" or "can't connect to the server" errors, even after 72 hours, when trying to access it from off the network.

--If I browse to assets.ourwebsite.org/database on the server itself, I get to the website! But if I go to that page from any other computer, on or off the network, it doesn't work.

--The Server is running Windows Server 2003

So, what are my options? Do I have to talk to the HostMySite.com people to add this page? Shouldn't I just be able to use my server's name (ourcompanyadc.ourcompany.org) and have that route to the server? What's going on here! Is there a simple way to get a tiny local-server-hosted website online outside of the network?

View 2 Replies View Related

Site Shows Another's Site After Transfer

Jan 9, 2008

I just transferred a domain from one cpanel box to another.

Now, that site is showing someone else's page. I've seen this happen before, but I cannot remember the fix.

the virtual host in httpd.conf is fine, shows proper IP, username, docroot, etc

Dns zone is fine as well.

The domain is using the server's main IP, so that's not the cause.

Centos 5 / cpanel 11 / apache 1.3 / php 4x

View 4 Replies View Related

Is It Possible To Relay A Site From My Site?

Aug 28, 2006

is possible to relay a site (say abc.com) from my site (xyz.com), where a viewer should be able to see the site (abc.com) through my site's IP.

View 4 Replies View Related

What If You Can't FTP Into A Site?

Nov 7, 2006

i've got a client who gave me their PW and ID to log into their servers. But for whatever reason, i can't seem to login despite them giving me the right PW and ID.

I want to know if there are other possible reasons for not being able to login via my FTP client [which is filezilla]?

View 4 Replies View Related

Is This Too Much CPU/MEM For One Site

Jun 2, 2008

I found the CPU/MEM/MySQL usage in cPanel (how have I missed it before and when talking with my host (fully managed Liquideb VPS2 768MB RAM 1024 Burst (though it reads it as that I think). Anyways it seems my friends sites are using allot of CPU and RAM. See attached screenshot. He is paying for shared hosting but I was stupid to give him unlimited sites but 1GB space 10GB bandwidth. Am I over reacting, or his his $16/month or 1% of available space (based on 95GB for paying sites) is he using too much?

Here's the screenshot. He is FIshbon, Empower, and rhea and both sites are drupal (along with 2 of my sites one being macwrite and the other personal).

View 5 Replies View Related

For Mp3 Site

Aug 19, 2008

I knw that it is not legal to provide mp3 files for downloads.But still there are thousands of sites which are offering free mp3 downloads.How they are managing it?Are their servers in a country where it is legal.If so,Which country's servers are best for these kind of sites?

View 6 Replies View Related

Site Down Another Not

Jun 22, 2008

My site host in Dreamhost.

why Adulu.com down but Adolu.com not.

check it out

View 5 Replies View Related

Site Down For Some, And Not For Others

Apr 3, 2007

I'm getting emails that my site is down and does not load. But it's working find for others. 1 person is in Vancouver, and the other in Ontario.

View 4 Replies View Related

My Site Is Down Again

Feb 6, 2007

I got this in my email cpsrvd failed @ Tue Feb 6 08:33:22 2007. A restart was attempted automagicly.

I checked that all of my sites that are using php program doesn't work. Genetips.com doesn't work.

So I restarted the server.

Now, the site "work" but they cannot access database.

Accessing genetips.com will show that databases cannot be accessed.

View 5 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved