Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [attacks]

90 questions
9
votes
2 answers

DNS attacks from external IP with port 80, how could that happened?

Just noticed from my DNS server's log, showing someone attack my server through port 80: /var/log/bind.log:31-Jul-2020 03:25:50.536 query-errors: client @0x7f63345948a0 185.107.80.2#36045 (PEACECORPS.GOV): view internet: query failed (REFUSED) for…
watchsat
  • 101
  • 1
  • 5
7
votes
1 answer

Windows RDP: Attack targeting real account names

We have a Windows 2012 R2 server hosted in a datacenter, and we are using RDP for its administration. Automatic updates are enabled. RDP login is not allowed for the Administrator account, and there are several user accounts with RDP enabled. I…
Olivier Leneveu
  • 171
  • 3
6
votes
4 answers

How to stop a ICMP attack?

We are under a heavy icmp flood attack. Tcpdump shows the result below. Altough we have blocked ICMP with iptables tcpdump still prints icmp packets. I've also attached iptables configuration and "top" result. Is there any thing I can do to…
cumhur onat
  • 163
  • 1
  • 4
4
votes
3 answers

Lots of connections in SYN_RECV, not a SYN flood, is it some reflection attack?

Since at least a few months, issuing a netstat -t command on our web server, which has TCP ports 22, 80 and 443 exposed to the Internet, often reveals dozens of connections in SYN_RECV status: $ netstat -nt Active Internet connections (w/o…
Ale
  • 1,613
  • 17
  • 25
3
votes
1 answer

Is this real google bot or attack? How do I deal with it?

So basically my site was unaccessible and I went to logs folder to see what's wrong and noticed a lot of weird requests from various IPs: 155.4.117.13 - - [30/Mar/2020:20:23:45 +0300] "GET / HTTP/1.0" 200 6189 "-" "Google Bot" 185.220.100.252 - -…
me_yy
  • 33
  • 3
2
votes
1 answer

Suspicious ssh log entries (“Accepted none for anonymous”)

I got this log entry chain (and similar repeatedly) on my server: Nov 24 07:38:59 server sshd[28676]: SSH: Server;Ltype: Version;Remote: 54.38.81.12-40482;Protocol: 2.0;Client: OpenSSH_7.2p2 Ubuntu-4ubuntu2.4 Nov 24 07:38:59 server sshd[28676]: SSH:…
Cigydd
  • 21
  • 6
2
votes
1 answer

TMG only windows 2008 r2 installing. NOT WORKING windows server 2012 r2

TMG Forefront only working windows server 2008 or 2008R2 - Not working windows server 2012. How to mitigation windows server 2012R2 - Flood attacks,http attacks ? Please help how to build windows server 2012R2 Maximum TCP connect requests per minute…
Ahmet Berk Başaran
  • 31
  • 5
2
votes
1 answer

What's the legit use of a deauthentication packet?

Most people that have tampered with external wireless networks in a malicious fashion for the sake of education (hopefully your own personal testing network) have probably heard of a deauthentication attack. These attacks are simply a single host…
TheFuzzyFish
  • 23
  • 3
2
votes
0 answers

What would cause named to send out hundreds of bogus responses?

My DNS server running RHEL 6.6 is actively sending unsolicited DNS responses to a couple of IP's. By unsolicited I mean that there is no incoming request from the external IP, the DNS server seems to want to talk to this external host for some…
user53029
  • 619
  • 2
  • 14
  • 34
2
votes
2 answers

500,000 GET requests to a random jpeg per day (Apache)

So I'm getting this on my Apache log on a small server for a local company: 1.2.3.4 - - [09/Nov/2015:17:00:16 +0000] "GET /wp-content/uploads/2012/08/gold-coins.jpeg HTTP/1.1" 301 342 about 500,000 times per day with 150,000 unique IP's. I've…
user321255
  • 21
  • 2
2
votes
1 answer

Another domain points to my webserver

Somebody else has registered a name pointing to my webserver's IP address in .ma TLD. My domain foo.bar -> my ip address 1.2.3.4 Somebody defined: suspiciousdomain.ma -> my ip address 1.2.3.4 So this looks like a reverse to typical DNS…
LetMeSOThat4U
  • 1,159
  • 2
  • 14
  • 29
2
votes
1 answer

What sort of attack URL is this?

I set up a website with my own custom PHP code. It appears that people from places like Ukraine are trying to hack it. They're trying a bunch of odd accesses, seemingly to detect what PHP files I've got. They've discovered that I have PHP files…
Asker
  • 41
  • 1
  • 3
2
votes
2 answers

Reverse Proxy - should it be a different technology stack?

Got a skeptical question about a reverse proxy setup I'm considering. I've currently got a pair of load balanced application servers in the DMZ (S1,S2 in figure below). These accept inbound requests from external clients. They also connections to…
Happyblue
  • 75
  • 1
  • 8
2
votes
1 answer

Ping O' Death and iptables

Is there a simple rule that can be written to stop a ping o' death with iptables?
John
  • 2,266
  • 6
  • 44
  • 60
2
votes
4 answers

Server FTP attack from multiple IP addresses spanning 5 countries - how can this be?

I recently had an FTP attack where 3 files were copied into public HTML directory of my domain. (It looks like the FTP password was compromised, but I'm still investigating this.) The strange thing is that the FTP log documented 5 separate IP…
Owen
  • 356
  • 5
  • 19
1
2 3 4 5 6