trying to find a spammer on my system, who just sent out and is still sending out 4000+ emails...
i have a centos vps with whm.
looked at exim_mainlog, there's nothign telling. the message body is visible, but the links it points to arent' hosted by me. there is no return address, its sending mail as nobody. phpsuexec is not an option.
Anyone got any special programs or tools they use to find out what specific account and domain is abusing server resources?
I am running WHM/cPanel latest build along with the latest Apache, PHP, and MySQL.
I were already at two paid hosts and had no good experience.
Then I have tried a few freehosts and saw a lot of rubbish.
I searched and searched, chatted to support chats of hosts - but no luck yet!
then I came here and now I ask you to find a right (US) hosting service...
First I tell you what site I have, that you can truly estimate:
I have a private website and on it are many photoshop pictures for the design of my website (15kb-200kb per picture).
I offer 3D models for binary downloading in zip files (filesize
1 MB - 15 MB each). I need html, php, SSI, mysql, phpmyadmin, .htaccess and cpanel. I have alexa tracking, google ads and few other javascript tracking providers on my site which are loading heavy according to my former hosts opinion. I have few banner ads, popups, flash animations, the usual things on a site that it looks good to gamers.
Gamers are my main audience.
Diskspace used: currently 500 MB.*
Bandwidth: currently 150 GB / month*
Daily unique hits / pages: 15000.*
* Those values might grow in future.
Optional I have a bb forum for responses and questions installed, but I would reduce to HTML only, if it would be needed.
One host kicked me out without warning because of bandwidth / CPU, before I have used the bandwidth limit specified in my hosting plan.
Another one threw me out without notification because of 'abuse of server resources', whereby the reason or script has been not specified.
In both cases I have no clue what I had to do about.
I have only HTML, a MYBB, pictures, javascript, one database
and lots of traffic ofc.
Now I need a host who is willing / able to host that.
It's a private non-profit site, so the costs should be adequate.
I think I'm unable to go dedicated by fees, it should be still shared hosting.
My competition has similar sites, even larger. They host for free or for shared fees. I cannot ask them and didn't find out where they would host.
A domain I have already. Need just the DNS servers to point to a new host.
finding this file
iam stuck in middle of install,that install need the below file
i tried in google i cant find it can anyone help me
to find the file
ffmpeg-SVN-r14473.tar.gz
I'm trying to transfer a cms from 1 site to another and I don't know the full ftp path.. I'm looking for the "/public_html/username/blank/blank/sitefolder" or something similar.. How do I figure this out?
View 2 Replies View RelatedResponse time from my web server (running LAMP) was really slow this evening. mpstat showed nothing, CPU hovered under 5%, mem usage around 25%, iowait minimal. mysql processlist was mostly idle, no slow queries logged. Only other thing I can think of is the connection from the host itself? (Not my local connection as multiple users complained about slow performance.)
Concurrent users was higher than average, but shouldnt this manifest itself in higher CPU util?
My question was, is there something besides network latency I could be looking at? If it is network latency, what's the easiest way for me to confirm this? A simple ping?
I have a VDS with 20GB drive, currently its running at 81% capacity, I have looked around but am of the opinion its not the accounts that are using that much space.
Is there a simple method of finding out whihc folders are using all the space?
1- is it possible to find out any server hardware info ?
2- is it possible to find out a web site is in which type of server (Resseller ? Dedicated ? VPS ? or x?)
I have searched the internet all over , to find a web host that offers :
FREE Domain Mapping
Full support of Wordpress << MySQL , PHP Send mail
Hot linking enabled
Great uptime
Decent bandwidth
speedy servers
NoOo Ads , and the ability to put mine
did it mention it should be?
i need to find al www folders within home directory with 777 permissions and need to chmod to 750.
if possible post the command to do it
Is there a method for tracking events prior to severe server load? I get these load spikes and am trying to track down their cause ..
OS: CentOS
I'm doing some research into EU data centres and was trying to find a list of good, reliable centres that offer good speeds to, and around, the whole of Europe - especially the UK.
The provider we currently use is LeaseWeb (NL), who have been very good, however, due to their servers being a very specific specification and currently not what we're looking for, we are looking for a good replacement.
I don't think I would like a centre that is located in the UK, whilst it would be better for us, it would not benefit all of our customers - a host somewhere in the middle would do great.
Currently have the following and pay $134 a month:
OS: CENTOS 4.7
Hardware: AMD HP A64 4200 DC/2GB/250GB SATA
Bandwidth: 1500GB
Control Panel: cPanel + Fantastico
IPs: 5 Useable
Location: US
I don't like my host, and would like to move to a similar price point with a new host. I am capable of managing almost all aspects of my server, only the initial configuration of things like PHP sometimes throw me.
This is my second time finding for a shared hosting. I am with ASMALLORANGE now, not that happy with it. I will post a review later on.
I need to host 3 sites, A static website; two wordpress.500mb space;
10gb bandwidth;
5 or more each for add-on domains; subdomain; email; sql etc.
Prefer to pay around $7USD. A buck more is alright.
I have a site that is currently hosted in Australia and loads relatively quickly there , but it is very slow in Uk and France.
Eli kindly set up a trial at blurstorm but I am unhapy with the way it loads in australia which is its primary audience.
how to get my speeds up with the site? ATM there is a 2.8 mb swf file that loads in about 5 sec in aus but about 20 in europe.
Blurstorm is faster in europe(france)but unacceptably slow in Aus.
Is blurstorm considered fast servers on their reseller plans? Or do I need to upgrade my expenditure to get what I want?
as you can see on my status2k 3306 is not my mysql port number. I cannot for the life of me figure out what it is. I don't remember changing it and my host will not help me figure out what it is.
I have root login and it's running centos and cpanel.
to fire up a P4 in California to target Asia. GBLX or Sprint or AT&T transit is a must. The usage for this server would be a ~7mbps average with 5 hour daily bursts up to 20mbps(comes out to around 2300GB).
PacificRack seemed perfect for my needs, but won't answer sales emails...I've read good things, but i'm worried about signing up.
My budget is around $200, this shouldn't be a problem right?
See attached screencaps for load problem. I'm the only user on the machine and only run gallery2.
First response from support:
#########################
Load averaged is calculated by the number of processes that want to run / over how much CPU time they want.
On a multi processor box, you need to read load with a grain of salt.
A load of 4 on a box with 4 cpus is the same as a load of 1 on a box with a single cpu.
A load of 8 is not high enough for me to freak out on a 4 cpu box. I would up the limits of the stats processing in statistics configuration.
###########################
I replied:
Did you guys make any changes after my ticket? Load dropped, but the server was responding slowly, and when I clicked on apache status in WHM it said unable to process. I restarted apache via WHM and that error went away. Right now it says:
Server uptime: 59 minutes 34 seconds
Total accesses: 187164 - Total Traffic: 65.0 MB
CPU Usage: u641.12 s66.88 cu0 cs0 - 19.8% CPU load
52.4 requests/sec - 18.6 kB/second - 364 B/request
150 requests currently being processed, 0 idle servers
The gallery is performing faster since the reset.
Two questions:
1) Right after the reset the server load as reported by WHM jumped from 1 to 10 (where it remains) why?
2) When I see the load spike, say to 30, how can I figure out the cause? The load as reported by WHM might already be divided by four processors because when I put the gallery on a single core server, load jumps to 50+
They replied:
##################################
I didn't see any changes to the configuration, I have however made some of my own changes to the configuration at this time to better cycle connections :
root@ [/usr/local/apache/conf]# diff httpd.conf httpd.conf.bak.fmerrill
107c107
< Timeout 60
---
> Timeout 300
126c126
< KeepAliveTimeout 5
---
> KeepAliveTimeout 15
142c142
< MaxSpareServers 20
---
> MaxSpareServers 10
148c148
< StartServers 10
---
> StartServers 5
157c157
< MaxClients 350
---
> MaxClients 150
173c173
< MaxRequestsPerChild 5000
---
> MaxRequestsPerChild 0
####################################
Support didn't give me much info, how do I find the cause of the load - looks like httpd - should I switch to a company that can install apache2 w/cpanel 11, which is multithreaded and could make better use of the 4(?) processors? Why did the load jump back up to "normal" after restarting apache?
You use "top", you see an Apache PID using 100% CPU - how do you find out which page it's displaying, basically anything to work out what's causing the problem?
The "top" display is great, but it's only a starting point.
I got a cPanel notification that one of my client's had exceeded their bandwidth and so the site was down.
Checking, I found in AWStats that nearly 400+ MB was web traffic. It looks normal to me. However, AWStats simply grouped them all together under 'Others' without providing clear details.
Is there any other way I can find out what made up that 400+MB traffic?
I am finding a monitoring software for my dedicated server that include monitoring web pages, Bandwidth...and i am using windows 2003 enterprise sp1
View 2 Replies View RelatedCan someoen tell me the commands to
1) Find a specific file
2) File all files with a certain extension i.e MP3
Using SSH on a linux server?
I know everyone has to make a living, I get that. But I am having a hard time wrapping my head around why I must pay $15 per month extra to a host for ram upgrades to the dedicated servers I am pricing out. Seems like a nickle and dime thing to me.
I don't understand how people can charge like they do. I suppose if your not on contract that they have to cover their ends but maybe I am just missing the point or looking for too good of a deal.
Any thoughts, or opinions are welcome. Looking for options on how to stop this.
Recently I've started receiving spam that appears to originate from a hosted domain on my VPS. It appears to only be an issue with this website account and not the VPS generally.
I've disabled the IMAP service to ensure the spam was not being sent from the server. The spam continues which leaves the POP email accounts as a possibility or something else.
My hosting provider says it looks like email spoofing.
Someone seems to be using the address at foobar.com to send out spam. The method that he has employed is called email spoofing. Email spoofing is the practice of changing your name in email so that it looks like the email came from somewhere or someone else. However, you need not be concerned.
Individuals, who are sending "junk" email or "SPAM", typically want the email to appear to be from an email address that may not exist. This way the email cannot be traced back to the originator. The spammer is not using our server to send out spam, hence your email address will never be blacklisted.
There is really no way to prevent receiving a spoofed email. Remember that although your email address may have been spoofed this does not mean that the spoofer has gained access to your mailbox.
The following are headers of two spam emails. Both of these addresses are setup as forwarders and not actual email accounts. The spam came to our attention because it is being sent to addresses on foobar.com with headers as also originating from foobar.com
I changed the actual names for privacy
host.vpsdomain.com [123.123.123.123] - VPS domain
foobar.com - website account on VPS
myemailaccount@gmail.com - address foobar forwarders send to
Delivered-To: myemailaccount@gmail.com .....
It looks like someone spammng from our server. I have checked exim_mainlog and got the this info.
2007-01-23 03:12:32 1H99Fz-0004wl-RV => erio@erio.com R=lookuphost T=remote_smtp H=mail.erio.com [217.220.27.241]
2007-01-23 03:12:40 1H99Fz-0004wl-RV => brown2525@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> beth46@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> dstanfie@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> harris3943@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> yumyyelow@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> gloverlm@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> debilu@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> mosleyclan4@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> 61369@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> melabong@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> k_mcmull@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> anniern@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> bannaj1@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> lizzied@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> gillumd@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> pfeiferk36@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> mommyof2@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> tongem@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> whitsonswrecker@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> mmal63@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> goosynina1@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> malenat@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> jlhk@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> tawndawn@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> usnssn@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> crazybutcute0304@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> thomas0421@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> mercibw@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> crouch1966@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> pj16@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> alba93@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> sassyd69@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> bettysue57@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> jimfiscus@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> nvonalme@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> breweragency@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> annaksimpson@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
In the log file is showing like this.
2007-01-22 19:11:24 1H99Fz-0004wm-Vp <= <> R=1H99Fz-0004wl-RV U=mailnull P=local S=605030
2007-01-22 19:11:24 1H99Fz-0004wl-RV <= stlawson100@yahoo.com.hk U=churchre P=local S=3558 id=23894.217.194.149.171.1169511083....el@65.xx.xx.xx
I couldn't find who is sending.
problem with spammers.. i installed bruteforce attack and apf but spammers still trying to use my mail server to spam.. bfa sending me 20-30 warning emails everyday like
Quote:
The remote system 200.83.230.214 was found to have exceeded acceptable login failures on xxxxxx; there was 62 events to the service exim. As such the attacking host has been banned from further accessing this system. For the integrity of your host you should investigate this event as soon as possible.
Executed ban command:
/etc/apf/apf -d 200.83.230.214 {bfd.exim}
The following are event logs from 200.83.230.214 on service exim (all time stamps are GMT -0600):
this spammers causing to load cpu very hi and freeze my server sometimes.
is there any way i can setup to only allow authenticated users to access the mail server. or any idea..
im not a hosting company hosting my websites and im a poor guy can't hire server admin.. and i have search it on google could'nt found anything..
Sometimes in the Dedicated Hosting Offers section you see people ping the providers IP and can discover other companies they go through, or if they are a reseller. Im wondering how I can go about finding out this information as well?
View 5 Replies View RelatedIs it possible to check the server specs of a particular site? Obviously I mean your competition?
View 10 Replies View Relatedprogramatic/scriptable way to find out which disk a file is on. For example, if I look at the output of: stat /root/.bashrc I see:
File: `/root/.bashrc'
Size: 1298 Blocks: 16 IO Block: 4096 regular file
Device: fd00h/64768d Inode: 13991942 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2008-05-18 09:19:14.000000000 -0400
Modify: 2007-12-18 09:19:54.000000000 -0500
Change: 2007-12-18 09:19:54.000000000 -0500
So I can see this is on device 64768, but how do I get from there to knowing that 64768 is really /dev/sda1, where in this example, I know the file actually is?
Overall, I want to resolve from the filename which device in the output of iostat contains that file - I don't necessarily have to go through stat, but it looks like a promising starting point.
I've just moved to a new dedicated server and need help finding and installing GD graphics and Imagemagick application. Anyone who know about where to find or install these modules please provide me some help.
My box has PHP version 5.2.5 installed. It only need GD graphics or Imagemagick for the photopost gallery to work.
One of my clients sites has just been hacked and im pretty sure its through the hosting and not the scripting, although the host us not being very helpfull.
What I want to do is see what other sites are on the shared account to see if any of them are having problems. As a coincidence the server has 'gone down' not long after being hacked which makes me think the host has pulled it.
I remember years ago (at least I hope I didnt dream it) that a website told me all the other sites on my server, probably by using some kind of reverse lookup on the IP, servers are not my strong point so I dont know.
where I can find this tool,
