Tagged Questions

The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
23 views

How to deny requests in nginx when there is no referer?

In nginx access.log I see many lines like: 1.2.3.4 - - [19/Oct/2014:22:48:11 -0400] "POST /someurl/suburl HTTP/1.1" 200 19967 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) ...
1
vote
1answer
25 views

How to deny POST to a url in nginx

Some of the sql heavy urls on my app (say /members) are being attacked by botnets. So I'd like to disable anybody to post to these urls, while allowing others to GET them. I tried to make a nested ...
4
votes
2answers
490 views

Will blocking port 25 on a router cripple outlook clients?

I work at a small ISP, we manage about 60 buildings with p2p radios and a main cisco router at a central location. Recently we were notified that a phishing domain is associated with one of our IPs. ...
0
votes
1answer
85 views

Is this a botnet? [closed]

I manage networking equipment at a small ISP for 60 highrise buildings. Each building has anywhere from 1 to 60 24 port switches, or some DSLAMs, or some coax gateways, with p2p radios on the roof, ...
0
votes
1answer
74 views

Postfix acting as spam server. Looks like it's part of a botnet, spam messages being sent to customers [duplicate]

Let me first start out by saying I am no mail guru. If you need more info to help me just let me know. This week the mail server has been having all sorts of strange issues. It has been duplicating ...
0
votes
0answers
56 views

What is causing this seemingly excessive ICMP traffic?

This seems to occur when I initiate a connection to an IP that I haven't previously before. Is this a botnet trying to say hi to his friends? As you can see I have an ip filter set in this image, ...
3
votes
1answer
702 views

/phpTest/zologize/axa.php? Another botnet?

Staring at the log made me think, what is /phpTest/zologize/axa.php and why are bots looking for it? Previously, I had lots of /HNAP1/ requests. Requesting /HNAP1/ from IPs from log revealed, that all ...
0
votes
1answer
44 views

How to view traffic operating on a specific port without plugging into egress interface? (Cisco IOS)

I'm trying to track down what host is infected with ZeroAccess on my network. It runs on ports 16464-16471. I would like to find this host without having to connect my laptop to the egress (WAN) ...
0
votes
0answers
29 views

Pounding the server with POST requests

Since last week one of my websites has been hit by the same king of attack described here: How to minimise effect of mischievous, persistent POST requests Even User-Agent string is the same: ...
-1
votes
1answer
241 views

blocking all countries except 4 at vlan level, will cisco asa 5505 hold?

First our server hold an application that only serve 4 countries. We had a repeated ddos from bonnet so would like to block all traffic except for the 4 countries that the application serve. the idea ...
1
vote
2answers
625 views

How can I block a malicious port scanner currently running on my server? [duplicate]

I'm currently attempting to clean and secure a server that has pnscan running on it. This instance of pnscan was installed by an outside party most likely to use our server as part of a port scanning ...
3
votes
2answers
250 views

What amount of effort and money should one invest against DDoS threats? [closed]

Typically, when you invest money to protect yourself against some possible threat, you should take into account two factors: the probability (p) of the problem actually happening how much money (m) ...
1
vote
1answer
79 views

sudo passwd on Ubuntu 11.10 strange behavior. Have I been rooted?

I'm in a really strange situation. A few hours ago Rackspace issued a ticket saying there's a outbound flood originating from my server. Thinking the server might have been rooted with a rootkit I ...
0
votes
2answers
1k views

iptables rules for botnet (UDP flood) protection

I'm currently experiencing a massive UDP attack on my server. I host a couple of gameservers, mainly Tf2, CS:GO, CS 1.6 and CS:Source, and my 1.6 server is being flooded. I tried different rules in ...
0
votes
2answers
262 views

How to defend agains botnet http requests

I have a server with WHM + CPanel and 5 of my costumer got infected with zbot. This means that the domains they have are constantly receiving requests to certain destinations. I tried to use ...
2
votes
1answer
509 views

I have many strange requests in my httpd access_log, does it mean I have a virus?

I have httpd log information as such which goes on and on forever. Firstly, does this mean I have a virus? is my server part of a botnet? My server is Linux Centos 5. tail -f ...
3
votes
5answers
485 views

Remote access of Linux over IRC

I have been tasked with setting up and supporting some computers for some people who have sociological problems. Troubled teens/adults and the like. They need computers to do very basic tasks like web ...
1
vote
1answer
1k views

Configuring Wireshark for Rolling Captures during DDoS Attack

We have been getting hit with DDoS Attacks on various machines for months. The datacenter either null routes or sets up an ACL for us. However, it just came to my attention there's a tool floating ...
2
votes
1answer
1k views

Packet flooding, is there any way to handle it?

My machine is being flooded with thousands of packets per second. They don't eat much bandwidth (60mbps out of 1gbit) but they damage system a lot by consuming a CPU responsible for handling network ...
0
votes
2answers
364 views

Defending against botnet - how to analyze apache logs?

About 24 hours ago a DDOS attack started against my site. The apache logs look like this: 190.56.92.50 - - [10/Nov/2011:19:09:16 +0200] "GET /browse.php HTTP/1.0" 403 1207 "-" "Mozilla/5.0 (Windows; ...
0
votes
2answers
835 views

how to detect botnet controller on the server [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY ZeuS backend controller abusive usage We have warned by our hosting company about there is a botnet controller (zeus) in our ...
4
votes
5answers
2k views

My server was reported to hoster abuse to perform ddos attacks. What should I do?

I do not see anything suspicious on the server (no netstat connections to remote 80 port), but I'm not a professional server admin (I'm a hardcore software developer). Please do not write obvious ...
1
vote
1answer
86 views

Can't figure out this attack, getting botnets and something else

About two months ago a site of mine started getting some sort of attack, and after further investigation I found it to be botnet zombies and something else which I can't figure out. My site is not ...
5
votes
8answers
9k views

How to check if a Linux server is clean from rootkits/backdoors/botnets etc.?

In case a Linux server was exposed to the internet with extreme low security policy (r/w anonymous Samba folders, Firebird database server with default admin password, no firewall, etc.) for a week, ...
3
votes
1answer
386 views

Mail server hammering

I've noticed a quick increase on smtp connections coming to my server, investigating it further i figured out that there's a botnet hammering my smtp server. I've tried to stop it by adding a rule at ...
0
votes
2answers
850 views

How to defend against botnet attack which tries to send a lot of mail to my server?

few days ago some kind of botnet attack started on my mail server which tries to send a lot of spam emails to certain domains on my mail server. Biggest issue here is that almost every attacker IP ...
5
votes
2answers
639 views

Storm Botnet on Linux?

We have a customer who is running an office CCTV system which he accesses from home. The system runs on an embedded Linux box behind a NAT firewall forwarding to ports 8080 for web browser access and ...