Questions tagged [botnet]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
2 answers
365 views

Block bad bot based on a query param signature

My nginx instance is getting hammered every couple of days by some bad bot using random query parameter values. /var/log/nginx/access.log:209.107.204.224 - - [14/Mar/2023:16:01:42 +0100] "GET /?...
Jovan Perovic's user avatar
1 vote
1 answer
117 views

What things should I consider when identifying and rate limiting bots?

// Not sure if this question is best fit for serverfault or webmasters stack exchange... I am thinking to rate limit access to my sites because identifying and blocking bad bots take most of my time. ...
adrianTNT's user avatar
  • 1,149
1 vote
0 answers
487 views

Apache mod QOS is blocking all users when it should only block per IP

I am running Apache web server on Ubuntu. I am trying to reduce the load on the server due to aggressive bot traffic. Thus I am trying to make use of Apache's mod QOS (http://mod-qos.sourceforge.net/...
AMF's user avatar
  • 141
0 votes
1 answer
51 views

How to defend against attackers looking for faulty code?

I have a production IIS running on WS2012R2 on AWS. I was looking at the C:\Windows\System32\LogFiles\HTTPERR when I noticed some unusual requests in the logs. You can look at some of what they tried ...
RisingSun's user avatar
  • 103
2 votes
1 answer
140 views

Too many bad bots killing website

Everyday around 2-3pm, huge amounts of bots are coming to my website and they just kill it. Few days ago it was just 2-3 IPs so I could easily block it, but today more than 600 bots came and kept ...
lamka02sk's user avatar
  • 121
2 votes
2 answers
4k views

How to determine process which makes DNS Request? [duplicate]

I have a server on AWS, GuardDuty started send me notifications: *** "type":"Backdoor:EC2/C&CActivity.B!DNS", *** {"domain":"libcurl.so","protocol":"UDP","blocked":false} *** is querying a domain ...
kbu's user avatar
  • 255
0 votes
0 answers
19 views

Miner bot taking up CPU on old server [duplicate]

I've been asked to take a look at an old web server (Ubuntu 12.04) which has been running very slow recently. After a quick check I found a process constantly topping the cpu: PID USER PR NI ...
Arturski's user avatar
  • 274
0 votes
0 answers
15 views

Block smtp botnet [duplicate]

My server provider shutdown one of our servers and it says that is sending a tons of email. When I made a tcpdump I see the following: 04:52:49.743068 IP <Our IP>.51796 > mail.dsityre.lk....
jackhammer013's user avatar
3 votes
1 answer
3k views

Block requests from bots by pattern in apache with mod_rewrite. mod_rewrite not working

I'm trying to block requests from bots by pattern glitter_calendar on apache. Prehistory. My server is heavily accessed by bots. The request URI is ...glitter_calendar.. The wordpress returns 404. ...
Tomas Morgan's user avatar
0 votes
1 answer
363 views

Random spikes of high ingress traffic. What could be the cause? [closed]

I understand that this is rather a generic question but wanted to see if you all could offer some good feedback. Our business has three locations, one in the West Coast, two in the East Coast. Our ...
vpaterno's user avatar
  • 113
1 vote
1 answer
340 views

Exim undergoing distributed dictionary attack

Our web server is currently undergoing a botnet attack on Exim. Our server is CentOS and is setup with BFD (Brute Force detect that uses APF to prevent access) to detect attempts and block them. ...
Neo's user avatar
  • 187
0 votes
1 answer
446 views

Apache2 Mod_spamhaus Whitelist

We are using Apache2 mod_spamhaus and many customers were banned using the "Post" method. There is no way to deny mod_spamhaus ban continuously our customers making false positive or ban ...
User-N's user avatar
  • 265
2 votes
1 answer
10k views

How to deny requests in nginx when there is no referer?

In nginx access.log I see many lines like: 1.2.3.4 - - [19/Oct/2014:22:48:11 -0400] "POST /someurl/suburl HTTP/1.1" 200 19967 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/...
Jand's user avatar
  • 213
6 votes
1 answer
21k views

How to deny POST to a url in nginx

Some of the SQL-heavy URL on my app (say /members) are being attacked by botnets. So I'd like to disable anybody to post to these URL, while allowing others to GET them. I tried to make a nested ...
Jand's user avatar
  • 213
5 votes
2 answers
2k views

Will blocking port 25 on a router cripple outlook clients?

I work at a small ISP, we manage about 60 buildings with p2p radios and a main cisco router at a central location. Recently we were notified that a phishing domain is associated with one of our IPs. ...
demiAdmin's user avatar
  • 155
-1 votes
1 answer
185 views

Is this a botnet? [closed]

I manage networking equipment at a small ISP for 60 highrise buildings. Each building has anywhere from 1 to 60 24 port switches, or some DSLAMs, or some coax gateways, with p2p radios on the roof, ...
demiAdmin's user avatar
  • 155
0 votes
1 answer
330 views

Postfix acting as spam server. Looks like it's part of a botnet, spam messages being sent to customers [duplicate]

Let me first start out by saying I am no mail guru. If you need more info to help me just let me know. This week the mail server has been having all sorts of strange issues. It has been duplicating ...
HAL9000's user avatar
  • 149
0 votes
0 answers
706 views

What is causing this seemingly excessive ICMP traffic?

This seems to occur when I initiate a connection to an IP that I haven't previously before. Is this a botnet trying to say hi to his friends? As you can see I have an ip filter set in this image, ...
user40262's user avatar
3 votes
1 answer
1k views

/phpTest/zologize/axa.php? Another botnet?

Staring at the log made me think, what is /phpTest/zologize/axa.php and why are bots looking for it? Previously, I had lots of /HNAP1/ requests. Requesting /HNAP1/ from IPs from log revealed, that all ...
m132's user avatar
  • 141
1 vote
1 answer
334 views

How would I scan for botnets being hosted on my server? [closed]

I know this may sound like a noob type question but, I want to know if there are any programs/techniques out there that scan for botnets being hosted on a server. I run a small hosting company and ...
mike's user avatar
  • 21
0 votes
1 answer
95 views

How to view traffic operating on a specific port without plugging into egress interface? (Cisco IOS)

I'm trying to track down what host is infected with ZeroAccess on my network. It runs on ports 16464-16471. I would like to find this host without having to connect my laptop to the egress (WAN) ...
Copy Run Start's user avatar
-1 votes
1 answer
960 views

blocking all countries except 4 at vlan level, will cisco asa 5505 hold?

First our server hold an application that only serve 4 countries. We had a repeated ddos from bonnet so would like to block all traffic except for the 4 countries that the application serve. the idea ...
user3376096's user avatar
1 vote
2 answers
1k views

How can I block a malicious port scanner currently running on my server? [duplicate]

I'm currently attempting to clean and secure a server that has pnscan running on it. This instance of pnscan was installed by an outside party most likely to use our server as part of a port scanning ...
Zack Lerner's user avatar
3 votes
2 answers
302 views

What amount of effort and money should one invest against DDoS threats? [closed]

Typically, when you invest money to protect yourself against some possible threat, you should take into account two factors: the probability (p) of the problem actually happening how much money (m) ...
MiniQuark's user avatar
  • 3,995
1 vote
1 answer
94 views

sudo passwd on Ubuntu 11.10 strange behavior. Have I been rooted?

I'm in a really strange situation. A few hours ago Rackspace issued a ticket saying there's a outbound flood originating from my server. Thinking the server might have been rooted with a rootkit I ...
qwexar's user avatar
  • 111
0 votes
2 answers
4k views

iptables rules for botnet (UDP flood) protection

I'm currently experiencing a massive UDP attack on my server. I host a couple of gameservers, mainly Tf2, CS:GO, CS 1.6 and CS:Source, and my 1.6 server is being flooded. I tried different rules in ...
Petar Simeonov's user avatar
0 votes
2 answers
877 views

How to defend agains botnet http requests

I have a server with WHM + CPanel and 5 of my costumer got infected with zbot. This means that the domains they have are constantly receiving requests to certain destinations. I tried to use ...
Killercode's user avatar
3 votes
1 answer
919 views

I have many strange requests in my httpd access_log, does it mean I have a virus?

I have httpd log information as such which goes on and on forever. Firstly, does this mean I have a virus? is my server part of a botnet? My server is Linux Centos 5. tail -f /var/log/httpd/...
Phil's user avatar
  • 265
3 votes
5 answers
2k views

Remote access of Linux over IRC

I have been tasked with setting up and supporting some computers for some people who have sociological problems. Troubled teens/adults and the like. They need computers to do very basic tasks like web ...
Porch's user avatar
  • 680
1 vote
1 answer
2k views

Configuring Wireshark for Rolling Captures during DDoS Attack

We have been getting hit with DDoS Attacks on various machines for months. The datacenter either null routes or sets up an ACL for us. However, it just came to my attention there's a tool floating ...
Aidan Knight's user avatar
2 votes
1 answer
3k views

Packet flooding, is there any way to handle it?

My machine is being flooded with thousands of packets per second. They don't eat much bandwidth (60mbps out of 1gbit) but they damage system a lot by consuming a CPU responsible for handling network ...
rfire's user avatar
  • 41
0 votes
2 answers
683 views

Defending against botnet - how to analyze apache logs?

About 24 hours ago a DDOS attack started against my site. The apache logs look like this: 190.56.92.50 - - [10/Nov/2011:19:09:16 +0200] "GET /browse.php HTTP/1.0" 403 1207 "-" "Mozilla/5.0 (Windows; ...
user avatar
0 votes
2 answers
3k views

how to detect botnet controller on the server [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY ZeuS backend controller abusive usage We have warned by our hosting company about there is a botnet controller (zeus) in our server. ...
Utku Dalmaz's user avatar
  • 1,359
4 votes
5 answers
3k views

My server was reported to hoster abuse to perform ddos attacks. What should I do?

I do not see anything suspicious on the server (no netstat connections to remote 80 port), but I'm not a professional server admin (I'm a hardcore software developer). Please do not write obvious ...
Nikolay R's user avatar
  • 143
1 vote
1 answer
102 views

Can't figure out this attack, getting botnets and something else

About two months ago a site of mine started getting some sort of attack, and after further investigation I found it to be botnet zombies and something else which I can't figure out. My site is not ...
Bernard's user avatar
  • 19
9 votes
8 answers
27k views

How to check if a Linux server is clean from rootkits/backdoors/botnets etc.?

In case a Linux server was exposed to the internet with extreme low security policy (r/w anonymous Samba folders, Firebird database server with default admin password, no firewall, etc.) for a week, ...
Ivan's user avatar
  • 3,398
3 votes
1 answer
698 views

Mail server hammering

I've noticed a quick increase on smtp connections coming to my server, investigating it further i figured out that there's a botnet hammering my smtp server. I've tried to stop it by adding a rule at ...
Rod's user avatar
  • 371
0 votes
2 answers
2k views

How to defend against botnet attack which tries to send a lot of mail to my server?

few days ago some kind of botnet attack started on my mail server which tries to send a lot of spam emails to certain domains on my mail server. Biggest issue here is that almost every attacker IP ...
GrZeCh's user avatar
  • 605
5 votes
2 answers
738 views

Storm Botnet on Linux?

We have a customer who is running an office CCTV system which he accesses from home. The system runs on an embedded Linux box behind a NAT firewall forwarding to ports 8080 for web browser access and ...
MikeJ-UK's user avatar
  • 201