Questions tagged [malicious]
The malicious tag has no usage guidance.
33
questions
0
votes
0
answers
164
views
Checking visitors IP for open port 25 smtp and blocking this IP
I try to figure out which IP is a residential proxy. The most IP's with a fraud score +75 has an open port 25.
A normal visitor's IP does not have port 25 open.
So you can assume that it is a ...
- 1
1
vote
1
answer
811
views
WordPress MYSQL DB BINARY LOG - Droplet/SERVER Volume Increasing rapidly
My WordPress website uses Nginx. Recently I have noticed that server volume has increased from 8GB to 40GB. I have found that the WordPress MYSQL Binary Log is taking more space. Each second, database ...
1
vote
0
answers
29
views
Malicious files generating in CentOS 7 directory /usr/bin [duplicate]
I installed a CentOS 7 at my Virtual Machine,
As i have installed the antivirus on the machine i found some files in /usr/bin which coming as Malicious content, i backup them and again they generated ...
0
votes
1
answer
305
views
My Server is sending malicious SSH requests [duplicate]
I am facing weird issue on my server (Unix). There are couple vendors reported me that my server is sending malicious requests to their server by using SSH Protocol.
I have already checked the system ...
- 11
0
votes
0
answers
57
views
Is my server sending malicious requests?
I'm running a VPS with Ubuntu 20.04. Yesterday I received notice from my VPS provider that they got an abuse report pointing to the ip of my server. After some back-and-forth they asked the reporter ...
- 1
1
vote
3
answers
468
views
What happens if you "print" an application or program in Windows?
What happens if you right click on an application/program in Windows, and click "Print"? I accidentally almost did this when I right clicked a program icon to open from the desktop, but accidentally ...
- 123
1
vote
1
answer
36
views
Malicious Code detected generated error page
We started getting an error page when we post iframes or scripts on our sites. Whether it's from the admin or a test script on a "test.php" page.
The problem is we don't know what is generating this ...
-1
votes
1
answer
73
views
40.96.18.165 keeps visiting my web server
Something/someone from 40.96.18.165 has been hitting my web server exactly eight times a day everyday since Feb 5, 2017. The user agent used is Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0).
...
- 397
2
votes
1
answer
4k
views
Countless (defunct?) SSH processes -how do stop it from happening?
My vServer hoster threatens to cancel our contract if I don't stop creating thousands (9000 to be precise) of SSH processes. I don't know if they made the processes defunct or if they were like this ...
- 129
1
vote
1
answer
436
views
Getting heavy traffic from random IP addresses
Digital ocean closed my droplet dude to have traffic on droplet.
I made a new droplet(instance) and I am facing the same issue again.
My nginx access.log is full of random ip address trying to make ...
1
vote
0
answers
72
views
LMD/Maldetect: Missing target-file operand after
After running mallet 1.5 in screen-mode (# maldet -a /var/www) I'm getting this return:
maldet(6070): {scan} 618017/618044 files scanned: hits 0 cleaned/usr/bin/wc: /usr/local/maldetect/tmp/.sess....
- 913
1
vote
3
answers
8k
views
clamscan using maldet Error: Servname not supported for ai_socktype
So i have installed Linux Malware Detect (maldet) to scan a server and everything went fine with installation but when i run it i get an error. Bunch of errors and than the scan just closes it.
Here ...
- 124
-1
votes
1
answer
130
views
What use are systems that ban IP addresses if all the evildoers spoof them anyways
Many anti-spam or web applications with a security component give the ability to ban IP addresses. In my experience any bot, person or other entity that is truly nefarious is using an endless supply ...
- 101
0
votes
1
answer
555
views
sed comand - remove virus from wordpress [duplicate]
I have malicious code in every php file. This malicius code is auto paste at the beginning of file. I want to remove this with UNIX command from console.
This is malicious code:
<?php $...
- 127
0
votes
0
answers
79
views
Malicious Resources on Linux Server?
When creating a website, I often include custom fonts (which I upload via FTP and reference via CSS). I get these font files from various locations on the web.
I was wondering: is it possible for a ...
- 111
0
votes
1
answer
851
views
How to detect malicious script in my CentOS server? [duplicate]
I am warned from my VPS provider that my server sends a lot of SSH SYN Attack to other servers, but I have no idea how to deal with it.
Here's the detail my provider sent me:
Where can I find the ...
- 1,615
0
votes
1
answer
649
views
Almost all of our websites within our server is redirecting to a porno scammy sites [duplicate]
We are having a problem within our server. After transferring the files to a new dedicated server, within only one or two weeks almost every website under our server is redirecting to a porno scammy ...
- 23
-1
votes
2
answers
713
views
Detect malicious script or reason creating lots of smtp connection [duplicate]
My VPS was suspended due to lots of SMTP connection(over 2000) per hour. But I am pretty sure none of my script was sending mail. I am using google apps and live service for mail. I have blocked my ...
- 101
0
votes
1
answer
388
views
How protect from DDOS attack? [closed]
I have many requests with refferer like alexa.com google.com and etc. to main and couple another pages of site. Line from access.log
109.172.15.39 - - [11/Jan/2013:02:30:30 +0400] "GET /topic?...
- 159
-1
votes
1
answer
1k
views
IIS 7 Serving all pages with an injected iframe [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
This is not a duplicate. The question above doesn't explain how that can be done.
My VPS just got hacked an all my pages are being ...
- 371
0
votes
1
answer
878
views
how to detect malicious activity from my server
I'm using a linode virtual server.
My machine is Ubuntu 10.04.
I got a ticket from Linode that they detected malicous activity coming from my server.
"We have detected your system with an IP of, , ...
- 115
0
votes
1
answer
1k
views
Critical Virus infection with PHP website. What are the options to remove Virus? [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
I have a critical virus infection to one of my website.
There is a additional script found added at footer of few web pages . the pages ...
- 101
1
vote
1
answer
1k
views
Malicious script changing .htaccess files on server [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
There seems to be a malicious script accessing my server and editing the .htaccess files for all of my hosted sites to redirect towards ...
- 111
1
vote
3
answers
974
views
Ssh log monitor
Are there any tools to monitor ssh logs at /var/log/secure and report activity?
I am looking for some tools that will proactively tell me about user actions and highlight malicious activity.
I don’t ...
- 4,393
-1
votes
2
answers
442
views
how to find who is perform malicious activity in shared hosting server
I am a shared webhosting provider, I got a complain:
* COMPLAINT *
| *.*(server shared ip) | 2011-09-17 20:02:12 | jakarta.dreamhost.com | 1807770 | oscommerce remote upload from 'categories....
- 37
-3
votes
1
answer
95
views
Is there an up to date list of malicious IPs so that I can block them? [closed]
I'm looking for a comprehensive and up to date list of malicious IPs from all around the world so that I can block them in the servers I manage.
I searched the net alot for it but I couldn't find ...
- 479
1
vote
3
answers
425
views
What is this script that's been injected into our website?
This morning I discovered that a script has appeared in multiple locations on two of our websites.
Needless to say I'm recovering the sites from backups, changing our passwords and trawling the FTP ...
- 121
1
vote
3
answers
1k
views
Is it worthwhile to block malicious crawlers via iptables?
I periodically check my server logs and I notice a lot of crawlers search for the location of phpmyadmin, zencart, roundcube, administrator sections and other sensitive data. Then there are also ...
- 1,473
0
votes
2
answers
237
views
Domain points me to some malicious URL and I can't get rid of it
Whenever I enter my URL into the browser, it keeps pointing me to
http://fornax.myvnc.com/dev
The URL doesn't even work and my antivirus doesn't complain about it so I am not sure what is happening....
- 147
0
votes
2
answers
551
views
Malicious Script on LAMP Server
We have recently noticed that a malicious script is inserting itself in a number of PHP and HTML files on our domain questoons.com and the various add-on domains hosted on this account. The script ...
Vinayak
2
votes
3
answers
277
views
Strange requests coming from Korean Site
Lately I've been finding a lot of strange requests like this coming to my rails app:
Processing ApplicationController#index (for 189.30.242.61 at 2009-12-14 07:38:24) [GET]
Parameters: {"_SERVER"=&...
- 133
-6
votes
1
answer
5k
views
How to remove my site from blacklist of google chrome and mozilla [closed]
Hai guys,
I removed all malicious code from my website pages and javascript files but still i cant view my site in firefox and google chrome.....
- 149
3
votes
5
answers
2k
views
php site defacing [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
someone is intruding in our site and putting following line in our main page (index.php):: In the following code bottom.php is our own ...
jimit