The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
0answers
26 views

Suspicious domains in DNS logs

I'm seeing a lot of domains in our networks DNS logs (recursive) that all seem to be related and all return some sort of hash on port 80 Does anyone know what software is using them? ...
0
votes
0answers
15 views

How to find server hacker [duplicate]

I have WHM CPanel and cxs plugin installed to scan for malicious scripts. Today I just got notified that a file has been uploaded to my server: Scanning web upload script file... Time ...
0
votes
1answer
47 views

Countless (defunct?) SSH processes -how do stop it from happening?

My vServer hoster threatens to cancel our contract if I don't stop creating thousands (9000 to be precise) of SSH processes. I don't know if they made the processes defunct or if they were like this ...
0
votes
0answers
11 views

CentOS Drupal Site/Domain Sending UDP Attacks on Different IPs [duplicate]

My Drupal 7 site is hosted on a Cent-OS 6.5 VM. The hosting service provider notified me about an malicious activity on site and site is sending UDP packets on different IPs. Following is data ...
1
vote
1answer
88 views

Getting heavy traffic from random IP addresses

Digital ocean closed my droplet dude to have traffic on droplet. I made a new droplet(instance) and I am facing the same issue again. My nginx access.log is full of random ip address trying to make ...
1
vote
0answers
22 views

LMD/Maldetect: Missing target-file operand after

After running mallet 1.5 in screen-mode (# maldet -a /var/www) I'm getting this return: maldet(6070): {scan} 618017/618044 files scanned: hits 0 cleaned/usr/bin/wc: ...
0
votes
2answers
2k views

clamscan using maldet Error: Servname not supported for ai_socktype

So i have installed Linux Malware Detect (maldet) to scan a server and everything went fine with installation but when i run it i get an error. Bunch of errors and than the scan just closes it. Here ...
-1
votes
1answer
90 views

What use are systems that ban IP addresses if all the evildoers spoof them anyways

Many anti-spam or web applications with a security component give the ability to ban IP addresses. In my experience any bot, person or other entity that is truly nefarious is using an endless supply ...
0
votes
1answer
307 views

sed comand - remove virus from wordpress [duplicate]

I have malicious code in every php file. This malicius code is auto paste at the beginning of file. I want to remove this with UNIX command from console. This is malicious code: <?php ...
0
votes
0answers
63 views

Malicious Resources on Linux Server?

When creating a website, I often include custom fonts (which I upload via FTP and reference via CSS). I get these font files from various locations on the web. I was wondering: is it possible for a ...
0
votes
1answer
360 views

How to detect malicious script in my CentOS server? [duplicate]

I am warned from my VPS provider that my server sends a lot of SSH SYN Attack to other servers, but I have no idea how to deal with it. Here's the detail my provider sent me: Where can I find the ...
0
votes
1answer
365 views

Almost all of our websites within our server is redirecting to a porno scammy sites [duplicate]

We are having a problem within our server. After transferring the files to a new dedicated server, within only one or two weeks almost every website under our server is redirecting to a porno scammy ...
-1
votes
2answers
535 views

Detect malicious script or reason creating lots of smtp connection [duplicate]

My VPS was suspended due to lots of SMTP connection(over 2000) per hour. But I am pretty sure none of my script was sending mail. I am using google apps and live service for mail. I have blocked my ...
0
votes
1answer
312 views

How protect from DDOS attack? [closed]

I have many requests with refferer like alexa.com google.com and etc. to main and couple another pages of site. Line from access.log 109.172.15.39 - - [11/Jan/2013:02:30:30 +0400] "GET ...
-1
votes
1answer
903 views

IIS 7 Serving all pages with an injected iframe [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY This is not a duplicate. The question above doesn't explain how that can be done. My VPS just got hacked an all my pages are being ...
0
votes
1answer
378 views

how to detect malicious activity from my server

I'm using a linode virtual server. My machine is Ubuntu 10.04. I got a ticket from Linode that they detected malicous activity coming from my server. "We have detected your system with an IP of, ...
0
votes
1answer
684 views

Critical Virus infection with PHP website. What are the options to remove Virus? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I have a critical virus infection to one of my website. There is a additional script found added at footer of few web pages . the ...
1
vote
1answer
787 views

Malicious script changing .htaccess files on server [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY There seems to be a malicious script accessing my server and editing the .htaccess files for all of my hosted sites to redirect ...
1
vote
3answers
470 views

Ssh log monitor

Are there any tools to monitor ssh logs at /var/log/secure and report activity? I am looking for some tools that will proactively tell me about user actions and highlight malicious activity. I don’t ...
-1
votes
2answers
396 views

how to find who is perform malicious activity in shared hosting server

I am a shared webhosting provider, I got a complain: * COMPLAINT * | *.*(server shared ip) | 2011-09-17 20:02:12 | jakarta.dreamhost.com | 1807770 | oscommerce remote upload from ...
-3
votes
1answer
85 views

Is there an up to date list of malicious IPs so that I can block them? [closed]

I'm looking for a comprehensive and up to date list of malicious IPs from all around the world so that I can block them in the servers I manage. I searched the net alot for it but I couldn't find ...
1
vote
3answers
364 views

What is this script that's been injected into our website?

This morning I discovered that a script has appeared in multiple locations on two of our websites. Needless to say I'm recovering the sites from backups, changing our passwords and trawling the FTP ...
1
vote
3answers
1k views

Is it worthwhile to block malicious crawlers via iptables?

I periodically check my server logs and I notice a lot of crawlers search for the location of phpmyadmin, zencart, roundcube, administrator sections and other sensitive data. Then there are also ...
0
votes
2answers
217 views

Domain points me to some malicious URL and I can't get rid of it

Whenever I enter my URL into the browser, it keeps pointing me to http://fornax.myvnc.com/dev The URL doesn't even work and my antivirus doesn't complain about it so I am not sure what is ...
0
votes
2answers
542 views

Malicious Script on LAMP Server

We have recently noticed that a malicious script is inserting itself in a number of PHP and HTML files on our domain questoons.com and the various add-on domains hosted on this account. The script ...
2
votes
3answers
247 views

Strange requests coming from Korean Site

Lately I've been finding a lot of strange requests like this coming to my rails app: Processing ApplicationController#index (for 189.30.242.61 at 2009-12-14 07:38:24) [GET] Parameters: ...
-6
votes
1answer
4k views

How to remove my site from blacklist of google chrome and mozilla [closed]

Hai guys, I removed all malicious code from my website pages and javascript files but still i cant view my site in firefox and google chrome.....
3
votes
5answers
698 views

php site defacing [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY someone is intruding in our site and putting following line in our main page (index.php):: In the following code bottom.php is our ...