Questions tagged [malicious]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
20 views

Figure out ways to forward traffic through proxy for Home network from external 3rd party

I noticed all my traffic goes through one ip address which seems a proxy and this proxy is not set up neither by me or my provider (I contacted them on this issue). I want to figure out who and how ...
user avatar
  • 1
0 votes
1 answer
288 views

WordPress MYSQL DB BINARY LOG - Droplet/SERVER Volume Increasing rapidly

My WordPress website uses Nginx. Recently I have noticed that server volume has increased from 8GB to 40GB. I have found that the WordPress MYSQL Binary Log is taking more space. Each second, database ...
user avatar
1 vote
0 answers
29 views

Malicious files generating in CentOS 7 directory /usr/bin [duplicate]

I installed a CentOS 7 at my Virtual Machine, As i have installed the antivirus on the machine i found some files in /usr/bin which coming as Malicious content, i backup them and again they generated ...
user avatar
0 votes
1 answer
181 views

My Server is sending malicious SSH requests [duplicate]

I am facing weird issue on my server (Unix). There are couple vendors reported me that my server is sending malicious requests to their server by using SSH Protocol. I have already checked the system ...
user avatar
0 votes
0 answers
48 views

Is my server sending malicious requests?

I'm running a VPS with Ubuntu 20.04. Yesterday I received notice from my VPS provider that they got an abuse report pointing to the ip of my server. After some back-and-forth they asked the reporter ...
user avatar
1 vote
3 answers
288 views

What happens if you "print" an application or program in Windows?

What happens if you right click on an application/program in Windows, and click "Print"? I accidentally almost did this when I right clicked a program icon to open from the desktop, but accidentally ...
user avatar
  • 123
1 vote
1 answer
30 views

Malicious Code detected generated error page

We started getting an error page when we post iframes or scripts on our sites. Whether it's from the admin or a test script on a "test.php" page. The problem is we don't know what is generating this ...
user avatar
-1 votes
1 answer
72 views

40.96.18.165 keeps visiting my web server

Something/someone from 40.96.18.165 has been hitting my web server exactly eight times a day everyday since Feb 5, 2017. The user agent used is Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0). ...
user avatar
1 vote
1 answer
3k views

Countless (defunct?) SSH processes -how do stop it from happening?

My vServer hoster threatens to cancel our contract if I don't stop creating thousands (9000 to be precise) of SSH processes. I don't know if they made the processes defunct or if they were like this ...
user avatar
  • 119
1 vote
1 answer
421 views

Getting heavy traffic from random IP addresses

Digital ocean closed my droplet dude to have traffic on droplet. I made a new droplet(instance) and I am facing the same issue again. My nginx access.log is full of random ip address trying to make ...
user avatar
1 vote
0 answers
62 views

LMD/Maldetect: Missing target-file operand after

After running mallet 1.5 in screen-mode (# maldet -a /var/www) I'm getting this return: maldet(6070): {scan} 618017/618044 files scanned: hits 0 cleaned/usr/bin/wc: /usr/local/maldetect/tmp/.sess....
user avatar
  • 893
1 vote
3 answers
8k views

clamscan using maldet Error: Servname not supported for ai_socktype

So i have installed Linux Malware Detect (maldet) to scan a server and everything went fine with installation but when i run it i get an error. Bunch of errors and than the scan just closes it. Here ...
user avatar
-1 votes
1 answer
123 views

What use are systems that ban IP addresses if all the evildoers spoof them anyways

Many anti-spam or web applications with a security component give the ability to ban IP addresses. In my experience any bot, person or other entity that is truly nefarious is using an endless supply ...
user avatar
0 votes
1 answer
526 views

sed comand - remove virus from wordpress [duplicate]

I have malicious code in every php file. This malicius code is auto paste at the beginning of file. I want to remove this with UNIX command from console. This is malicious code: <?php $...
user avatar
0 votes
0 answers
78 views

Malicious Resources on Linux Server?

When creating a website, I often include custom fonts (which I upload via FTP and reference via CSS). I get these font files from various locations on the web. I was wondering: is it possible for a ...
user avatar
  • 111
0 votes
1 answer
836 views

How to detect malicious script in my CentOS server? [duplicate]

I am warned from my VPS provider that my server sends a lot of SSH SYN Attack to other servers, but I have no idea how to deal with it. Here's the detail my provider sent me: Where can I find the ...
user avatar
  • 1,455
0 votes
1 answer
548 views

Almost all of our websites within our server is redirecting to a porno scammy sites [duplicate]

We are having a problem within our server. After transferring the files to a new dedicated server, within only one or two weeks almost every website under our server is redirecting to a porno scammy ...
user avatar
  • 23
-1 votes
2 answers
687 views

Detect malicious script or reason creating lots of smtp connection [duplicate]

My VPS was suspended due to lots of SMTP connection(over 2000) per hour. But I am pretty sure none of my script was sending mail. I am using google apps and live service for mail. I have blocked my ...
user avatar
  • 101
0 votes
1 answer
373 views

How protect from DDOS attack? [closed]

I have many requests with refferer like alexa.com google.com and etc. to main and couple another pages of site. Line from access.log 109.172.15.39 - - [11/Jan/2013:02:30:30 +0400] "GET /topic?...
user avatar
  • 159
-1 votes
1 answer
1k views

IIS 7 Serving all pages with an injected iframe [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY This is not a duplicate. The question above doesn't explain how that can be done. My VPS just got hacked an all my pages are being ...
user avatar
0 votes
1 answer
863 views

how to detect malicious activity from my server

I'm using a linode virtual server. My machine is Ubuntu 10.04. I got a ticket from Linode that they detected malicous activity coming from my server. "We have detected your system with an IP of, , ...
user avatar
  • 115
0 votes
1 answer
933 views

Critical Virus infection with PHP website. What are the options to remove Virus? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I have a critical virus infection to one of my website. There is a additional script found added at footer of few web pages . the pages ...
user avatar
  • 101
1 vote
1 answer
1k views

Malicious script changing .htaccess files on server [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY There seems to be a malicious script accessing my server and editing the .htaccess files for all of my hosted sites to redirect towards ...
user avatar
  • 111
1 vote
3 answers
866 views

Ssh log monitor

Are there any tools to monitor ssh logs at /var/log/secure and report activity? I am looking for some tools that will proactively tell me about user actions and highlight malicious activity. I don’t ...
user avatar
  • 4,273
-1 votes
2 answers
441 views

how to find who is perform malicious activity in shared hosting server

I am a shared webhosting provider, I got a complain: * COMPLAINT * | *.*(server shared ip) | 2011-09-17 20:02:12 | jakarta.dreamhost.com | 1807770 | oscommerce remote upload from 'categories....
user avatar
  • 37
-3 votes
1 answer
93 views

Is there an up to date list of malicious IPs so that I can block them? [closed]

I'm looking for a comprehensive and up to date list of malicious IPs from all around the world so that I can block them in the servers I manage. I searched the net alot for it but I couldn't find ...
user avatar
  • 459
1 vote
3 answers
423 views

What is this script that's been injected into our website?

This morning I discovered that a script has appeared in multiple locations on two of our websites. Needless to say I'm recovering the sites from backups, changing our passwords and trawling the FTP ...
user avatar
1 vote
3 answers
1k views

Is it worthwhile to block malicious crawlers via iptables?

I periodically check my server logs and I notice a lot of crawlers search for the location of phpmyadmin, zencart, roundcube, administrator sections and other sensitive data. Then there are also ...
user avatar
  • 1,453
0 votes
2 answers
236 views

Domain points me to some malicious URL and I can't get rid of it

Whenever I enter my URL into the browser, it keeps pointing me to http://fornax.myvnc.com/dev The URL doesn't even work and my antivirus doesn't complain about it so I am not sure what is happening....
user avatar
  • 147
0 votes
2 answers
550 views

Malicious Script on LAMP Server

We have recently noticed that a malicious script is inserting itself in a number of PHP and HTML files on our domain questoons.com and the various add-on domains hosted on this account. The script ...
user avatar
2 votes
3 answers
274 views

Strange requests coming from Korean Site

Lately I've been finding a lot of strange requests like this coming to my rails app: Processing ApplicationController#index (for 189.30.242.61 at 2009-12-14 07:38:24) [GET] Parameters: {"_SERVER"=&...
user avatar
-6 votes
1 answer
5k views

How to remove my site from blacklist of google chrome and mozilla [closed]

Hai guys, I removed all malicious code from my website pages and javascript files but still i cant view my site in firefox and google chrome.....
user avatar
  • 149
3 votes
5 answers
2k views

php site defacing [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY someone is intruding in our site and putting following line in our main page (index.php):: In the following code bottom.php is our own ...
user avatar