Questions tagged [attacks]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
2 answers
151 views

Server is currently under massive DDoS

Over the past few days, been having a number of problems that I can only describe as a massive DDoS attack one a CENTOS VPS server that is only hosting one website. The website is really slow but not ...
Phorce's user avatar
  • 101
2 votes
1 answer
3k views

What's the legit use of a deauthentication packet?

Most people that have tampered with external wireless networks in a malicious fashion for the sake of education (hopefully your own personal testing network) have probably heard of a deauthentication ...
a25bedc5-3d09-41b8-82fb-ea6c353d75ae's user avatar
0 votes
0 answers
126 views

MYSQL error: IP address could not be resolved [duplicate]

My website is hosted with Linode, I installed webmin on Ubuntu 14.04 to manage it. Recently my database server keeps shutting down, when I look at /var/log/mysql, there are several log files in there ...
shenkwen's user avatar
  • 199
-6 votes
1 answer
506 views

Someone else domain is pointed to my IP [closed]

I've just done a routine reverse IP check. And saw that 2 domains are pointing to my IP. This is getting me really worried, as I was told they could be preparing to attack my server. What exactly ...
Nikk's user avatar
  • 239
-3 votes
1 answer
731 views

Port scan attacks detected from my server [duplicate]

I have dedicated server for my personal projects on Hetzner and today was the second time I got email from them informing that they detected portscan coming from server (first time was in January). At ...
Adrian Serafin's user avatar
1 vote
1 answer
133 views

Apache 404 errors with "hello" as URL

My web server emails me if a 404 error occurs (to help me with missing links). I only had the usual 404's like http://www.example.com/administrator and so on. But lately I keep getting a request for ...
G Trawo's user avatar
  • 153
2 votes
0 answers
508 views

What would cause named to send out hundreds of bogus responses?

My DNS server running RHEL 6.6 is actively sending unsolicited DNS responses to a couple of IP's. By unsolicited I mean that there is no incoming request from the external IP, the DNS server seems to ...
user53029's user avatar
  • 649
-4 votes
2 answers
411 views

Where do the Chinese, Russian and etc. random attackers find their targets?

I recently started running a personal site on a dedicated server that i've had for some time, but have never actually used. I have never checked it's logs, but now when i do, auth.log is full with ...
Adrian Todorov's user avatar
2 votes
2 answers
169 views

500,000 GET requests to a random jpeg per day (Apache)

So I'm getting this on my Apache log on a small server for a local company: 1.2.3.4 - - [09/Nov/2015:17:00:16 +0000] "GET /wp-content/uploads/2012/08/gold-coins.jpeg HTTP/1.1" 301 342 about 500,000 ...
user321255's user avatar
-1 votes
1 answer
78 views

Server Blocked by Provider Sending UDP Packages to certain IP - what does that mean?

My webserver got blocked by my provider recently for the reason that it was performing an attack to another server. The email contained the following log: 08:26:39.219940 68:05:ca:07:02:01 > 78:fe:...
user3553828's user avatar
1 vote
1 answer
195 views

Server attack but on Upload not Download

I am currently being attacked on one of my servers, but I am struggling to find out what could be causing it. I have had a few DDoS attacks before but this particular attack, which I'm not sure what ...
Mr. Hedgehog's user avatar
1 vote
0 answers
1k views

How to block hping3 SYN ACK efficiently with iptables?

I'm trying to execute a TCP SYN flood on my Debian web server with nginx. Executing tcpdump "tcp[tcpflags] & (tcp-syn) != 0" while flooding, I see all packets coming. iptables seem to work well ...
Franzz's user avatar
  • 11
-1 votes
1 answer
57 views

web application audit task require my remote IP to be allowed on application network firewall [closed]

I want to audit a web application which is hosted on a web server sitting behind a cyberoam firewall. My task is to run a scan from my remote machine which has ISP MTNL broadband. My machine gets a ...
Luv Ahuja's user avatar
0 votes
1 answer
296 views

Any way to block DNS response using BIND?

I am using BIND as my DNS-server. I have disabled recursive DNS-request. Now I am under some kind of attack. Is there any was to block this or do I have to let it go? My query log: client 75.214.6....
fl0pp's user avatar
  • 13
0 votes
1 answer
1k views

What is a typical request rate per hour in a distributed attack?

I am concerned that some static files hosted publicly in S3 can be the target of an attack that aims to hurt me financially (ramping up my AWS bills). I have set up a logging system, that runs every ...
Victor's user avatar
  • 131
1 vote
3 answers
9k views

Email server attack from telnet

My mail server having a problem on blocking some attacker that trying to telnet to our mailserver. but i'm not able to block it, ip will keep changing even we block by ip. seems like he is trying to ...
Min Hong Tan's user avatar
-1 votes
2 answers
4k views

How to null route a dns zone [closed]

I have a domain that was attacked and flooding the server apache system. The only way to detour the attack is to reroute the dns off the server. Is there a generic IP like "127.0.0.1" that I can use ...
Charles Yarbrough's user avatar
1 vote
2 answers
129 views

Can't block spammy IP

I'm being attacked by 37.59.4.76. It's sending me a great amount of data, which is destroying my dataplan. I've added the iptables Chain num pkts bytes target prot opt in out ...
Hedam's user avatar
  • 193
0 votes
0 answers
77 views

Server usage topped 100% and crashed - how to diagnose and prevent

I'm running a small webserver on Ubuntu 12.04. Last night, the server topped off at 100% cpu usage and crashed. This is unusual as I'm normally around 1-5%. I suspect a DDoS attack from someone ...
user1732521's user avatar
2 votes
1 answer
356 views

Another domain points to my webserver

Somebody else has registered a name pointing to my webserver's IP address in .ma TLD. My domain foo.bar -> my ip address 1.2.3.4 Somebody defined: suspiciousdomain.ma -> my ip address 1.2.3.4 So ...
LetMeSOThat4U's user avatar
0 votes
2 answers
968 views

How to block requests for virtual hosts that dont exist in apache [duplicate]

First up, check out this question: Why are external domains appearing in my apache logs? We're seeing the exact same thing on one of our Debian VPS servers - with one big difference, the regularity ...
HeavenCore's user avatar
0 votes
1 answer
113 views

Network attack on dedicated server [duplicate]

I am using a dedicated server hosting for one of my project. I got a mail from my server provider that their monitoring system noticed a network scan (or network attack) from an IP address. The ...
Haider Ali's user avatar
0 votes
1 answer
341 views

What is maximum legitimate SYN traffic rate

Recently my server gets syn flood attack. I use hitcount limitation, but I wonder what is the maximum rate of legitimate syn traffic for a single user IP. The source-IP based rule I use is blow; ...
afelaho's user avatar
  • 101
1 vote
1 answer
64 views

How to set permissions for www/dir and make sure no security threats arise

I've a peculiar situation. I've VPS that I use for my own projects. A friend of mine asked me to host his wordpress blog. Now I've setup my VPS very straightforward, all projects are under /www and ...
Red Balloon's user avatar
1 vote
1 answer
484 views

How to read sFlow?

We currently have a very large outbound DDOS Attack coming from one of our machines which is on a Brocade switch and monitored by PRTG. I am looking at the sFlow v5 8 sensor and see Top Talkers and ...
Aidan Knight's user avatar
0 votes
2 answers
474 views

How can I decipher this HTTP PHP-request?

On my server I have serious HTTP an SSH attacks running. Most of them are brute force password checks or attemps of /etc/passwd retrievals. But some of them are trying to start the bash via plugin ...
math's user avatar
  • 453
-1 votes
2 answers
3k views

Should I suspicious of this behaviour? [closed]

My website users have perceived that sometimes the server performance is not as it used to be (basically they say that a page that normally loads immediately, could take more than 3 seconds now). This ...
Ivan's user avatar
  • 192
-1 votes
1 answer
4k views

I see my full site at another domain [duplicate]

Today I found one of my website fully being displayed at another domain that is not mine. Is this some kind of DNS hack or what is the purpose of these actions ? Because I seen this before, few years ...
adrianTNT's user avatar
  • 1,149
0 votes
1 answer
541 views

How to expose securely a Node.js/Express server into the real world?

Essentially I would like to know what the title suggests. Node.js/Express is nice. However, node is a fairly recent thing and hence there may be security risks by exposing the server to the real world....
MightyMouse's user avatar
0 votes
1 answer
868 views

Login failed for user 'sa'. ...... [CLIENT: 59.48.47.215]

I have an Amazon EC2 instance and i don't have anything running on it yet but my event log is full of below error "Login failed for user 'sa'. Reason: An attempt to login using SQL authentication ...
Parham's user avatar
  • 101
1 vote
1 answer
4k views

How To Protect Tomcat 7 Against Slowloris Attack

I'm using Apache Tomcat 7 to run my webapp on Linux. I scanned it by Acunetix and it's telling me that my webapp is vulnerable to "Slow HTTP Denial of Service Attack". How can I protect it? Acunetix ...
Amin Sh's user avatar
  • 131
1 vote
1 answer
2k views

What does this Apache access_log entry mean?

68.96.87.214 - - [07/Aug/2013:21:29:25 +0000] "GET /HNAP1/ HTTP/1.1" 403 501 "*************" "Mozilla/4.0 (compatible; Opera/3.0; Windows 4.10) 3.51 [en]" 177.47.105.41 - - [07/Aug/2013:21:57:26 +0000]...
Gasim's user avatar
  • 1,087
-5 votes
1 answer
491 views

How to protect against in-RAM attacks

Since hosting providers are constantly under attack from hackers, encryption of the entire file system (the entire server) with tools like www.truecrypt.org seems like an absolute must to me, if you ...
TomDogg's user avatar
  • 113
0 votes
1 answer
378 views

Are empty HTTP requests malicious?

I have seen multiple empty http request log entries from Apache: HOST:443 REMOTEIP - - [DATA AND TIME] "-" SIZE SIZE "-" "-" Are these malicious attacks, or some misconfiguration on my side?
user172594's user avatar
0 votes
1 answer
967 views

Tracking anonymous e-mail threat

A user spoofed/sent an email from http://emkei.cz/ with a very serious threat. Is it possible to trace this back or are we SOL? There wasn't much in the email headers other than that it came from ...
LaidBach's user avatar
0 votes
3 answers
2k views

POP / IMAP server under attack : what risks and how to secure?

Since yesterday (7am), our POP server is under a dictionnary attack : this is what I found in /var/log/mail.log : Mar 26 10:31:36 serv pop3d: LOGIN FAILED, user=monday, ip=[::ffff:91.121.**.***] Mar ...
Hugo H's user avatar
  • 119
0 votes
1 answer
392 views

How protect from DDOS attack? [closed]

I have many requests with refferer like alexa.com google.com and etc. to main and couple another pages of site. Line from access.log 109.172.15.39 - - [11/Jan/2013:02:30:30 +0400] "GET /topic?...
Dmitro's user avatar
  • 159
0 votes
1 answer
2k views

Netscan detected from host [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY Portscan attacks from somewhere I am using Hetzner's dedicated servers. Today I have got a message: We have received information that ...
Etam's user avatar
  • 171
1 vote
1 answer
234 views

Block IPs if they access a resource

I own a server that it's costantly being attacked by scripts (that try to access to phpMyAdmin's setup file's and stuff like this). I've heard that many people get this kinds of attacks, but I'm ...
Victor Oliva's user avatar
2 votes
1 answer
525 views

What sort of attack URL is this?

I set up a website with my own custom PHP code. It appears that people from places like Ukraine are trying to hack it. They're trying a bunch of odd accesses, seemingly to detect what PHP files I've ...
Asker's user avatar
  • 41
6 votes
4 answers
4k views

How to stop a ICMP attack?

We are under a heavy icmp flood attack. Tcpdump shows the result below. Altough we have blocked ICMP with iptables tcpdump still prints icmp packets. I've also attached iptables configuration and "top"...
cumhur onat's user avatar
1 vote
2 answers
274 views

I got some message about suspended site, which I have to debug, how do I proceed? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY The hosting company supplied an email to its client and the client wanted some help from me. the message states: Any items listed here ...
tough's user avatar
  • 113
2 votes
2 answers
2k views

Reverse Proxy - should it be a different technology stack?

Got a skeptical question about a reverse proxy setup I'm considering. I've currently got a pair of load balanced application servers in the DMZ (S1,S2 in figure below). These accept inbound requests ...
Happyblue's user avatar
1 vote
1 answer
185 views

Is it normal to collapse VPS CPU with this script?

This is the script, it comes with mod_evasive: #!/usr/bin/perl #test.pl: small script to test mod_dosevasive's effectiveness use IO::Socket; use strict; for(0..100) { my($response); my($SOCKET)...
user avatar
1 vote
4 answers
1k views

Solution for DDOS [duplicate]

My server is under DDoS attacks. I see my access log and get something: 968966 93-97-53-41.zone5.bethere.co.uk - - [27/Jul/2011:12:13:58 +0700] "GET /forum/forum.php HTTP/1.1" 200 91231 "-" "Mozilla/...
Tuan Ngo's user avatar
2 votes
1 answer
4k views

Ping O' Death and iptables

Is there a simple rule that can be written to stop a ping o' death with iptables?
John's user avatar
  • 2,276
0 votes
3 answers
485 views

avoid people running "stress tests" / attacks on our server (CentOS + Apache)

today we ran apachebench on our server to stress test it. Of course, our system peaked and disk I/O was massive. Can we avoid that other people run such "tests" or some sort of attack to stress our ...
solsol's user avatar
  • 1,131
2 votes
4 answers
1k views

Server FTP attack from multiple IP addresses spanning 5 countries - how can this be?

I recently had an FTP attack where 3 files were copied into public HTML directory of my domain. (It looks like the FTP password was compromised, but I'm still investigating this.) The strange thing is ...
Owen's user avatar
  • 356
0 votes
1 answer
179 views

Any way to stop people from img "framing" your site?

Someone was trying to get cute with me, by "iframeing" my search result page via an IMG tag with 0 width and 0 height, in hopes of killing my server resources. My searches are cached, so it doesn't do ...
user avatar
0 votes
1 answer
452 views

How Do I Secure WordPress Blogs Against Elemento_pcx Exploit?

I have a client who has several WordPress 2.9.2 blogs that he hosts. They are getting a deface kind of hack with the Elemento_pcx exploit somehow. It drops these files in the root folder of the blog: ...
ServerChecker's user avatar