0
Kayıt Ol

Sunucum Saldınrı Yapıyor

9

●

711

  • 14-07-2013, 07:21:14
    #1
    UnixCode
    UnixCode
    Selam arkadaşlar hetznerden aldıgım sunucunun saldırı yaptıgına dair hetznerden mail aldım. Eğer devam ederse sunucuyu kapatacaklar.
    Sorun şu ki hangi sitenin nasıl bunu yaptığını çözemedim.
    Bu durumu engellemenin bir yolu yok mu ?
    1 hafta önce aynı sorundan dolayı ip adresimi kitlemişlerdi ve zar zor açtırdım.
    Tekrar aynı durumun olmasını istemiyorum.

    Gönderdikleri mailden bir kesit ;

    Alıntı
    Dear Mr umut emre ,

    We received information that there is an attack on your server. The responsible people have been requested to solve the problem and to give a statement as to the reason.
    This is an information email and does not require any further action on your part. Should your server be locked down due to an attack, you will receive a separate notification. In that event, please contact our support team at support@hetzner.de.
    Alıntı
    We regret to inform you that your server with the IP address mentioned in the above subject line has been the target of an attack.

    As a result, this has placed a considerable strain on network resources and consequently a segment of our network has been very adversely affected.

    Your server has therefore been deactivated as a precautionary measure.

    A corresponding traffic protocol is attached for your information.

    Guidelines regarding further course of action may be found in our wiki:
    http://wiki.hetzner.de/index.php/Lei...versperrung/en
    Alıntı
    Direction IN
    Internal 176.9.35.102
    Threshold Traffic 200 MBit/s
    Sum 22,822 GByte/300s (623 MBit/s), 32.958.000 packets/300s (109.860
    packets/s), 25.822 flows/300s (86 flows/s)
    External 204.15.207.101, 0,023 GByte/300s (0 MBit/s), 22.000 packets/300s (73
    packets/s), 2 flows/300s (0 flows/s)
    External 213.176.143.42, 0,020 GByte/300s (0 MBit/s), 15.000 packets/300s (50
    packets/s), 3 flows/300s (0 flows/s)
    External 189.45.241.34, 0,017 GByte/300s (0 MBit/s), 19.000 packets/300s (63
    packets/s), 2 flows/300s (0 flows/s)
    External 202.89.66.4, 0,017 GByte/300s (0 MBit/s), 14.000 packets/300s (46
    packets/s), 3 flows/300s (0 flows/s)
    External 83.149.80.47, 0,017 GByte/300s (0 MBit/s), 14.000 packets/300s (46
    packets/s), 2 flows/300s (0 flows/s)
    External 80.246.183.173, 0,016 GByte/300s (0 MBit/s), 12.000 packets/300s (40
    packets/s), 2 flows/300s (0 flows/s)
    External 206.183.31.241, 0,015 GByte/300s (0 MBit/s), 11.000 packets/300s (36
    packets/s), 2 flows/300s (0 flows/s)
    External 59.124.103.132, 0,015 GByte/300s (0 MBit/s), 16.000 packets/300s (53
    packets/s), 2 flows/300s (0 flows/s)
    External 198.64.249.42, 0,015 GByte/300s (0 MBit/s), 12.000 packets/300s (40
    packets/s), 3 flows/300s (0 flows/s)
    External 115.28.32.205, 0,015 GByte/300s (0 MBit/s), 15.000 packets/300s (50
    packets/s), 2 flows/300s (0 flows/s)
    External 14.139.114.40, 0,014 GByte/300s (0 MBit/s), 10.000 packets/300s (33
    packets/s), 3 flows/300s (0 flows/s)
    External 42.96.190.196, 0,014 GByte/300s (0 MBit/s), 10.000 packets/300s (33
    packets/s), 2 flows/300s (0 flows/s)
    External 91.209.123.2, 0,014 GByte/300s (0 MBit/s), 10.000 packets/300s (33
    packets/s), 2 flows/300s (0 flows/s)
    External 72.10.208.8, 0,013 GByte/300s (0 MBit/s), 12.000 packets/300s (40
    packets/s), 2 flows/300s (0 flows/s)
    External 98.191.88.153, 0,013 GByte/300s (0 MBit/s), 10.000 packets/300s (33
    packets/s), 3 flows/300s (0 flows/s)
    External 182.50.1.165, 0,013 GByte/300s (0 MBit/s), 10.000 packets/300s (33
    packets/s), 2 flows/300s (0 flows/s)
    External 72.55.179.133, 0,013 GByte/300s (0 MBit/s), 13.000 packets/300s (43
    packets/s), 4 flows/300s (0 flows/s)
    External 124.207.0.102, 0,013 GByte/300s (0 MBit/s), 9.000 packets/300s (30
    packets/s), 2 flows/300s (0 flows/s)
    External 177.66.192.210, 0,013 GByte/300s (0 MBit/s), 9.000 packets/300s (30
    packets/s), 2 flows/300s (0 flows/s)
    External 150.254.201.102, 0,012 GByte/300s (0 MBit/s), 9.000 packets/300s (30
    packets/s), 2 flows/300s (0 flows/s)
    External 125.211.216.57, 0,012 GByte/300s (0 MBit/s), 9.000 packets/300s (30
    packets/s), 2 flows/300s (0 flows/s)
    External 81.7.237.178, 0,012 GByte/300s (0 MBit/s), 9.000 packets/300s (30
    packets/s), 2 flows/300s (0 flows/s)
    External 202.215.179.55, 0,012 GByte/300s (0 MBit/s), 9.000 packets/300s (30
    packets/s), 2 flows/300s (0 flows/s)
    External 213.142.137.26, 0,012 GByte/300s (0 MBit/s), 10.000 packets/300s (33
    packets/s), 2 flows/300s (0 flows/s)
    External 200.111.97.74, 0,012 GByte/300s (0 MBit/s), 9.000 packets/300s (30
    packets/s), 2 flows/300s (0 flows/s)
    External 219.148.104.189, 0,011 GByte/300s (0 MBit/s), 8.000 packets/300s (26
    packets/s), 2 flows/300s (0 flows/s)
    External 212.175.16.98, 0,011 GByte/300s (0 MBit/s), 8.000 packets/300s (26
    packets/s), 2 flows/300s (0 flows/s)
    External 219.255.134.6, 0,011 GByte/300s (0 MBit/s), 8.000 packets/300s (26
    packets/s), 2 flows/300s (0 flows/s)
    External 187.174.175.70, 0,011 GByte/300s (0 MBit/s), 8.000 packets/300s (26
    packets/s), 2 flows/300s (0 flows/s)
    External 60.206.255.6, 0,011 GByte/300s (0 MBit/s), 8.000 packets/300s (26
    packets/s), 2 flows/300s (0 flows/s)
    External 175.45.24.139, 0,011 GByte/300s (0 MBit/s), 8.000 packets/300s (26
    packets/s), 2 flows/300s (0 flows/s)
    External 202.143.162.93, 0,011 GByte/300s (0 MBit/s), 8.000 packets/300s (26
    packets/s), 3 flows/300s (0 flows/s)
    External 186.67.37.180, 0,011 GByte/300s (0 MBit/s), 8.000 packets/300s (26
    packets/s), 2 flows/300s (0 flows/s)
    External 121.8.100.34, 0,011 GByte/300s (0 MBit/s), 8.000 packets/300s (26
    packets/s), 2 flows/300s (0 flows/s)
    External 203.128.5.216, 0,011 GByte/300s (0 MBit/s), 8.000 packets/300s (26
    packets/s), 3 flows/300s (0 flows/s)
    External 222.240.131.61, 0,011 GByte/300s (0 MBit/s), 8.000 packets/300s (26
    packets/s), 2 flows/300s (0 flows/s)
    External 91.229.174.196, 0,011 GByte/300s (0 MBit/s), 9.000 packets/300s (30
    packets/s), 2 flows/300s (0 flows/s)
    External 85.95.231.231, 0,011 GByte/300s (0 MBit/s), 8.000 packets/300s (26
    packets/s), 2 flows/300s (0 flows/s)
    External 201.134.200.196, 0,011 GByte/300s (0 MBit/s), 8.000 packets/300s (26
    packets/s), 4 flows/300s (0 flows/s)
    External 116.55.171.82, 0,011 GByte/300s (0 MBit/s), 8.000 packets/300s (26
    packets/s), 2 flows/300s (0 flows/s)
    External 218.246.56.252, 0,010 GByte/300s (0 MBit/s), 12.000 packets/300s (40
    packets/s), 2 flows/300s (0 flows/s)
    External 123.108.45.2, 0,010 GByte/300s (0 MBit/s), 8.000 packets/300s (26
    packets/s), 3 flows/300s (0 flows/s)
    External 220.181.86.170, 0,010 GByte/300s (0 MBit/s), 8.000 packets/300s (26
    packets/s), 2 flows/300s (0 flows/s)
    External 78.40.226.159, 0,010 GByte/300s (0 MBit/s), 10.000 packets/300s (33
    packets/s), 3 flows/300s (0 flows/s)
    External 184.82.173.49, 0,010 GByte/300s (0 MBit/s), 9.000 packets/300s (30
    packets/s), 2 flows/300s (0 flows/s)
    External 42.96.167.35, 0,010 GByte/300s (0 MBit/s), 10.000 packets/300s (33
    packets/s), 2 flows/300s (0 flows/s)
    External 173.57.28.4, 0,010 GByte/300s (0 MBit/s), 8.000 packets/300s (26
    packets/s), 2 flows/300s (0 flows/s)
    External 77.238.20.77, 0,010 GByte/300s (0 MBit/s), 9.000 packets/300s (30
    packets/s), 4 flows/300s (0 flows/s)
    External 155.207.54.80, 0,010 GByte/300s (0 MBit/s), 8.000 packets/300s (26
    packets/s), 2 flows/300s (0 flows/s)
    External 42.121.145.98, 0,010 GByte/300s (0 MBit/s), 12.000 packets/300s (40
    packets/s), 2 flows/300s (0 flows/s)
  • 14-07-2013, 07:43:17
    #2
    barano
    barano
    Aleyküm Selam ;
    Windows İse Açtıgınız Başka Kullanıcı Yapıyor Olabilir.
  • 14-07-2013, 08:18:19
    #3
    UnixCode
    UnixCode
    Hayır linux server
  • 14-07-2013, 08:30:41
    #4
    kasirga098
    kasirga098
    Ssh portunu degstrp pyxsoft anti maleare ile tarat sunucuyu faudasını görürsün
  • 15-07-2013, 01:42:38
    #5
    adeministrator
    adeministrator
    sunucunun saldırı yaptığından emin misiniz? sanırım saldırı alıyorsunuz.
  • 15-07-2013, 10:59:39
    #6
    victories
    victories
    Direction IN dediğine göre saldırı alıyorsun.
  • 15-07-2013, 22:58:58
    #7
    Elazığlı168
    Elazığlı168
    sunucuoptimizasyon.com
    Saldırı çıkışı olsaydı 2.uyarıda sunucu açılmamak üzere kapanırdı, hetzner o konuda oldukça sert. Önlem olarak saldırı alan ip adresi üzerindeki siteleri cloudflare üzerine alabilirsiniz ancak saldırganın eski ip adresine saldırma ihtimali olacağından o ip adresini sunucudan çıkarın.
  • 16-07-2013, 13:56:36
    #8
    UnixCode
    UnixCode
    Peki arkadaşlar hangi sitenin saldırı aldığını görmezmiyim ? ip değişikliğiyle geçici çözüm oluyor. Adam siteye tekrar ip check yaptıgında yeni ip e tekrar saldırabilir.
    En mantıklı ihtimal o siteyi kaldırmak. Ama bunun içinde siteyi bilmek gerekiyor
  • 16-07-2013, 17:38:43
    #9
    abacus
    abacus
    UnixCode adlı üyeden alıntı: mesajı görüntüle
    Peki arkadaşlar hangi sitenin saldırı aldığını görmezmiyim ? ip değişikliğiyle geçici çözüm oluyor. Adam siteye tekrar ip check yaptıgında yeni ip e tekrar saldırabilir.
    En mantıklı ihtimal o siteyi kaldırmak. Ama bunun içinde siteyi bilmek gerekiyor
    Merhabalar : Hangi sitenin saldiri aldigini bulmaniz icin (/trafik turu saldirilar direk ip adresine geldigi icin/) kac adet web siteniz var bilmiyorum fakat saldiri almasi muhtemel olan siteleri sunucuda ki ip adreslerini cogaltarak dagitmaniz gerekir ancak bu sekilde bir fikir sahibi olabilirsiniz , bunun otesinde siteyi tespit edemezseniz top yekun sunucudaki tum ip adreslerine koruma saglayacak network duzeyinde bir ddos protection hizmetine ihtiyaciniz var.

    iyi calismalar.