Community Forums
Connect with us on LinkedIn
+ Reply to Thread
Results 1 to 6 of 6
  1. #1
    Member persianwhois's Avatar
    Join Date
    Apr 2007
    Location
    Mahallat
    Posts
    114

    Default My server attacked?

    Hello,
    my cpu load up to 586% and server crashed.
    I run following command in ssh:
    Code:
    netstat -autpn | grep :80 | awk '{print $5}' | cut -d. -f1-4 | cut -d: -f1 | sort -n | uniq -c | sort -n
    and i see:
    Code:
       
          1 0.0.0.0
          1 208.64.230.220
          1 212.180.4.150
          1 217.219.185.164
          1 217.219.225.98
          1 217.219.230.74
          1 217.219.56.214
          1 38.99.13.121
          1 66.36.228.42
          1 72.30.177.83
          1 72.30.177.98
          1 72.55.133.154
          1 74.6.69.213
          1 77.237.171.219
          1 80.191.211.131
          1 82.115.25.193
          1 82.99.248.74
          1 84.11.72.57
          1 84.47.210.5
          1 84.47.210.6
          1 84.47.210.7
          1 84.47.210.8
          3 85.185.3.22
          3 91.98.25.37
          4 217.218.183.3
          4 82.99.195.14
          6 195.146.33.250
        106 208.53.138.2
        162 67.15.211.15
        190 62.68.207.138
    IS MY SERVER DDOS ATTACKED?
    How can resolve this problem. i block attacker ip but he back and start attack again by new ip address.
    on my server mod_evasive and apf firewall installed.
    Help me please.
    Last edited by persianwhois; 06-14-2007 at 08:49 AM.
    Regards,
    Masood Yarmohammadi

  2. #2
    Member brianoz's Avatar
    Join Date
    Mar 2004
    Location
    Melbourne, Australia
    Posts
    1,117
    cPanel/Enkompass Access Level

    Root Administrator

    Default

    This looks more like a standard DOS rather than a DDOS. You'd be better off uninstalling APF and installing CSF which will detect and block these attacks effortlessly - you won't even know they are going on, apart from a notification email. APF isn't as good, or as stable, at detecting these sorts of attacks.

  3. #3
    Member persianwhois's Avatar
    Join Date
    Apr 2007
    Location
    Mahallat
    Posts
    114

    Default

    Quote Originally Posted by brianoz View Post
    This looks more like a standard DOS rather than a DDOS. You'd be better off uninstalling APF and installing CSF which will detect and block these attacks effortlessly - you won't even know they are going on, apart from a notification email. APF isn't as good, or as stable, at detecting these sorts of attacks.
    Thank you.
    i have two question:
    1- how can disable apf?
    2- how can remove apf?
    Regards,
    Masood Yarmohammadi

  4. #4
    Member serversphere's Avatar
    Join Date
    Jan 2004
    Posts
    658

    Default

    CSF has a script that will remove it for you. Download the script at configserver.com and when you untar it you will see disable_apf_bfd.sh - the shell script to do it.
    Darren Benfer | SS-Darren | AIM: serversphere
    www.serversphere.com
    Dedicated Server Solutions Have Come Full Circle

  5. #5
    Member persianwhois's Avatar
    Join Date
    Apr 2007
    Location
    Mahallat
    Posts
    114

    Default

    Quote Originally Posted by serversphere View Post
    CSF has a script that will remove it for you. Download the script at configserver.com and when you untar it you will see disable_apf_bfd.sh - the shell script to do it.
    Thank you.
    If i install csf, how can disable csf and back to apf if need?
    Regards,
    Masood Yarmohammadi

  6. #6
    Member serversphere's Avatar
    Join Date
    Jan 2004
    Posts
    658

    Default

    Run the unintsall in the CSF directory, then simply reintall APF...
    Darren Benfer | SS-Darren | AIM: serversphere
    www.serversphere.com
    Dedicated Server Solutions Have Come Full Circle

Similar Threads & Tags
Similar threads

  1. Server attacked by phishers
    By neonix in forum cPanel and WHM Discussions
    Replies: 3
    Last Post: 06-25-2007, 07:12 PM
  2. Am I being attacked?
    By PitadaVespa in forum cPanel and WHM Discussions
    Replies: 4
    Last Post: 06-22-2007, 06:59 AM
  3. help~ my mail server got attacked
    By goodgbb in forum cPanel and WHM Discussions
    Replies: 2
    Last Post: 09-27-2005, 07:42 AM
  4. How can i know that my server was attacked bye another or not?
    By 4402734 in forum cPanel and WHM Discussions
    Replies: 2
    Last Post: 09-21-2005, 11:40 AM
  5. please,help me my server is attacked
    By preleaf in forum cPanel and WHM Discussions
    Replies: 1
    Last Post: 10-11-2004, 10:56 PM
Linkedin       Facebook       Twitter       RSS       Flickr       YouTube