Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [botnet]

39 questions
0
votes
1 answer

Postfix acting as spam server. Looks like it's part of a botnet, spam messages being sent to customers

Let me first start out by saying I am no mail guru. If you need more info to help me just let me know. This week the mail server has been having all sorts of strange issues. It has been duplicating emails last week it wouldn't even let me connect…
HAL9000
  • 149
  • 1
  • 3
  • 8
0
votes
0 answers

What is causing this seemingly excessive ICMP traffic?

This seems to occur when I initiate a connection to an IP that I haven't previously before. Is this a botnet trying to say hi to his friends? As you can see I have an ip filter set in this image, it takes roughly 30-40 seconds for it to rack up…
user40262
  • 1
0
votes
1 answer

How to view traffic operating on a specific port without plugging into egress interface? (Cisco IOS)

I'm trying to track down what host is infected with ZeroAccess on my network. It runs on ports 16464-16471. I would like to find this host without having to connect my laptop to the egress (WAN) interface. (Because it would take down the internet…
Copy Run Start
  • 734
  • 1
  • 9
  • 27
0
votes
2 answers

iptables rules for botnet (UDP flood) protection

I'm currently experiencing a massive UDP attack on my server. I host a couple of gameservers, mainly Tf2, CS:GO, CS 1.6 and CS:Source, and my 1.6 server is being flooded. I tried different rules in iptables, but none of them seemed to work. I'm on…
Petar Simeonov
  • 1
  • 1
  • 2
0
votes
2 answers

How to defend agains botnet http requests

I have a server with WHM + CPanel and 5 of my costumer got infected with zbot. This means that the domains they have are constantly receiving requests to certain destinations. I tried to use mod_security but seems that it can't filter every…
Killercode
  • 133
  • 1
  • 1
  • 5
0
votes
2 answers

Defending against botnet - how to analyze apache logs?

About 24 hours ago a DDOS attack started against my site. The apache logs look like this: 190.56.92.50 - - [10/Nov/2011:19:09:16 +0200] "GET /browse.php HTTP/1.0" 403 1207 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3a) Gecko/20030105…
user79003
0
votes
2 answers

how to detect botnet controller on the server

Possible Duplicate: My server's been hacked EMERGENCY ZeuS backend controller abusive usage We have warned by our hosting company about there is a botnet controller (zeus) in our server. But we don't know how it is installed and how to detect and…
Utku Dalmaz
  • 1,329
  • 2
  • 13
  • 18
-1
votes
1 answer

Is this a botnet?

I manage networking equipment at a small ISP for 60 highrise buildings. Each building has anywhere from 1 to 60 24 port switches, or some DSLAMs, or some coax gateways, with p2p radios on the roof, with a main router at a central building. I…
demiAdmin
  • 155
  • 1
  • 9
-1
votes
1 answer

blocking all countries except 4 at vlan level, will cisco asa 5505 hold?

First our server hold an application that only serve 4 countries. We had a repeated ddos from bonnet so would like to block all traffic except for the 4 countries that the application serve. the idea is to block them by the vlan level. so will a…
user3376096
  • 11
1 2
3