what we are dealing with on win21

Customer Support Customer Only Discussion
1

Seems some nasty bots with fake agent names :frowning:

2008-06-23 15:59:59 W3SVC1 64.187.106.3 GET / - 80 - 81.215.23.122 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.0;+.NET+CLR+1.0.3705;+.NET+CLR+1.1.4322) 403 14 64
2008-06-23 15:59:59 W3SVC1 64.187.106.3 GET /index.phtml - 80 - 89.218.225.212 Mozilla/5.0+(X11;+U;+FreeBSD+i386;+en-US;+rv:1.5)+Gecko/20031021 404 0 64
2008-06-23 15:59:59 W3SVC1 64.187.106.3 GET /index.cgi - 80 - 89.218.225.212 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+Hotbar+4.3.1.0) 404 0 64
2008-06-23 15:59:59 W3SVC1 64.187.106.3 GET /game.php - 80 - 89.41.87.227 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+.NET+CLR+1.1.4322;+.NET+CLR+1.0.3705) 404 0 64
2008-06-23 15:59:59 W3SVC1 64.187.106.3 GET /1.php - 80 - 88.247.67.32 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+Avast+Browser+[avastye.com];+.NET+CLR+1.1.4322) 404 0 64
2008-06-23 15:59:59 W3SVC1 64.187.106.3 GET / - 80 - 88.253.9.76 Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98) 403 14 64
2008-06-23 15:59:59 W3SVC1 64.187.106.3 GET /index.phtml - 80 - 81.25.53.67 Mozilla/5.0+(Windows;+U;+Windows+NT+5.2;+en-US;+rv:1.5a)+Gecko/20030728+Mozilla+Firebird/0.6.1 404 0 64
2008-06-23 15:59:59 W3SVC1 64.187.106.3 GET / - 80 - 88.253.9.76 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+FunWebProducts-MyWay;+(R1+1.3);+.NET+CLR+1.1.4322) 403 14 64
2008-06-23 15:59:59 W3SVC1 64.187.106.3 GET /qwerty.php - 80 - 189.13.170.231 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows++NT+5.1;+Q312461) 404 0 64

this is just a small sample of what we have over 500000 hits of so far, and that is a very quick estimate of hits, possibly much higher as I stopped the logging on this detail level some hours ago

2

This is the work of an organized gang, won’t name names right now but there is some info, quite a bit in fact, about them online.

We are doing the most minimal logging possible at all and it is storming on in at an insane rate, but we are keeping the server running at very good levels, especially considering the attacks.

Doing the most minimal logging looks something like this:
2008-06-24 09:19:56 81.200.148.1 2287 64.187.106.3 80 HTTP/1.1 GET /game.php 503 1 Disabled Hsphere
2008-06-24 09:19:56 77.108.72.180 1934 64.187.106.3 80 HTTP/1.1 GET /list.php 503 1 Disabled Hsphere
2008-06-24 09:19:56 194.186.199.224 3784 64.187.106.3 80 HTTP/1.1 GET /config.php 503 1 Disabled Hsphere
2008-06-24 09:19:56 193.19.69.37 30562 64.187.106.3 80 HTTP/1.1 GET /index.pl 503 1 Disabled Hsphere
2008-06-24 09:19:56 79.120.112.34 9477 64.187.106.3 80 HTTP/1.1 GET /index.dhtml 503 1 Disabled Hsphere
2008-06-24 09:19:56 87.236.189.150 23677 64.187.106.3 80 HTTP/1.1 GET /bottom.php 503 1 Disabled Hsphere
2008-06-24 09:19:56 87.117.38.171 30574 64.187.106.3 80 HTTP/1.1 GET /index.php3 503 1 Disabled Hsphere
2008-06-24 09:19:56 80.92.96.44 2701 64.187.106.3 80 HTTP/1.1 GET /config.php 503 1 Disabled Hsphere
2008-06-24 09:19:56 88.239.61.55 4023 64.187.106.3 80 HTTP/1.1 GET /cgi-bin/index.pl 503 1 Disabled Hsphere
2008-06-24 09:19:56 77.234.15.223 3767 64.187.106.3 80 HTTP/1.1 GET /header.php 503 1 Disabled Hsphere
2008-06-24 09:19:56 80.92.96.44 2700 64.187.106.3 80 HTTP/1.1 GET /game.php 503 1 Disabled Hsphere
2008-06-24 09:19:56 87.117.38.171 30568 64.187.106.3 80 HTTP/1.1 GET /db.php 503 1 Disabled Hsphere
2008-06-24 09:19:56 193.223.98.86 61973 64.187.106.3 80 HTTP/1.1 GET /~/~/~/~/~/ 503 1 Disabled Hsphere
2008-06-24 09:19:56 88.205.212.241 52809 64.187.106.3 80 HTTP/1.1 GET /test.php 503 1 Disabled Hsphere

BARE minimums, and still getting 12-15MB per minute on these, it is almost double what it was yesterday at 1PM.

3

OK, in the forum it is written that win21 webshell works now - but today the whole day I get service unavailable and it seems it is not working. Is it just me or the webshell is stopped?

Lovely Wendie

4

Webshell is stopped again, I don’t think I put that it was up there?
I think it says Hsphere is up Webshell is down, I am about to head back to the datacenter and will reread and make sure there

we are still taking a huge impact on it :frowning: but client sites re staying up quite well thankfully!

5

Thank you for the information Stephen!

Vaportower Review

6

Hey Stephen,

Is there anything more I can do to keep this from affecting my sites on WIN21? How long has this been going on and is there any end in site? Thanks!

7

It has been going on since about 11am of the 23rd. (15ish min before this post)
http://support.jodohost.com/showthread.php?t=12433

End in sight, honestly in the past once blocked or site down, we have seen them to die away and not come back, thi sone is different, it is being run by from all we can see, the “Russian Business Network”

DDoS extortion investigation. Russia Business Network? | Web Hosting Talk

Hostfresh Illegal hosting | Web Hosting Talk

Please do NOT put this outside of the private forum, they have a vast network of bots(hijacked PCs from virii or trojans) and I do not wish to see the attacks increase on other servers. You can mention it to a client if needed, or you can be more in general and say it is a network of cyber thugs or something, but ensure it is not spread by name right now.

8

ivanrk,

Webshell IS enabled now.

9

Thanks for the update Stephen. That looks brutal and my sites are feeling it as well. I assume this not an attack on one of my sites or I would have noticed or been contacted, correct?

10

Hey Stephen,

One more thing. One of my sites is running ScanAlert which scans the site for vulnerabilities daily. I assume this is not an issue. Thanks!

11

We mailed the person that was being attacked, it was a russian(or russian dialect) site.

ScanAlert isn’t attacking like this :smiley:

12

we just surpassed 31GB of logs since these attacks started, that is truncated, limited as can get and still have the info logs. JUST the attacks are in this.

13

just for info, each 1MB log is 10100 hits, right now we are having 18 of these 1MB logs per minute to the attacked site.

14

Hey Stephen,

Today seemed noticeably worse than yesterday. The site on WIN21 seemed to go up and down all day long. I personally received “Service Unavailable” responses several times when surfing to the sites. I am definitely worried that this is hurting my clients business.

What more can I do? How do I move my sites to another server? Can this be done easily? The only thing that I think will be a headache is that they are both on dedicated IP addresses. Other than that they should be portable.

I have a ticket in about this issue and the responses are less than helpful. I am not sure why they would just let me know that this is cuased by a DDOS attack. The responses are basically the same each time and are not addressing the issue:

Hello,

I have checked and your domains are working fine. Please check it.

Feel free to contact us for further assistance.

With Regards,
Manish Srivastava

Hello,

Can you please check it now,
it should be fine now.

Feel free to contact us for further assistance.

Thanks and Regards
Akshay

Hello,

No there is no issue with hardware, also i check your website is working.
can you please check it now.

Feel free to contact us for further assistance.

Thanks and Regards
Akshay

Here are some script timeouts and monitoring errors I received yesterday and today:

Script timeouts:

Wed 6/25/2008 3:19 PM
Error Number: -2147012894
Error Description: The operation timed out

Wed 6/25/2008 3:17 PM
Error Number: -2147012894
Error Description: The operation timed out

Wed 6/25/2008 2:00 PM
Error Number: -2147012894
Error Description: The operation timed out

Wed 6/25/2008 1:56 PM
Error Number: -2147012894
Error Description: The operation timed out

Wed 6/25/2008 1:40 PM
Error Number: -2147012894
Error Description: The operation timed out

Wed 6/25/2008 7:36 AM
Error Number: -2147012894
Error Description: The operation timed out

Tue 6/24/2008 7:50 AM
Error Number: -2147012894
Error Description: The operation timed out

Monitoring Error Alerts:

Http error:503
Error was detected at 2008-06-25 11:43:40

Http error:Http_client.No_reply
Error was detected at 2008-06-25 14:16:45

Http error:503
First error was detected at 2008-06-25 11:43:40
Last error was detected at 2008-06-25 11:44:49

Http error:Http_client.No_reply
Error was detected at 2008-06-25 03:16:15

Http error:Http_client.No_reply
Error was detected at 2008-06-24 05:17:20

15

see the topic(announcements), we are migrating the ENTIRE(minus target site and shared IP) server. Yes its been worse than yesterday the magnitude of the attacks has gone up by a threshold of 15x coutning all the blocked IPs :frowning: