Anybody know who is attacking my network? - GoFuckYourself.com

mensniche · 04-20-2005, 05:17 AM

We have been down for 10 hours + now due to some fuck hacking our servers, anybody know who might be doing this or why??

I have been told it would be

1) Competitor
2) Affiliate trying to improve sales
3) Non Affiliate trying to fuck one of our affiliates sales up!

Any body know who to contact to get the fuck found?

8 Characters · 04-20-2005, 05:19 AM

1) or 3).

Do you have someone available who speaks Romanian?

DutchTeenCash · 04-20-2005, 05:19 AM

you took a peek at the log right? whats the ip resolving to?

mensniche · 04-20-2005, 05:20 AM

We have over 3000 IP's coming in so there using some major cloacking or bruat force

mensniche · 04-20-2005, 05:21 AM

yes loads - how come?

Dirty F · 04-20-2005, 05:21 AM

Ya post some info here. Log files and stuff.

Roald · 04-20-2005, 05:22 AM

sorry I will stop hitting CTRL F5 on your sites.

post some more info ;))

mensniche · 04-20-2005, 05:23 AM

Quote:

Originally Posted by Franck

Ya post some info here. Log files and stuff.

The log files show nothing becuase the IP's are spoofed

Darren · 04-20-2005, 05:25 AM

IF you have experience with this, ICQ ANDY

DutchTeenCash · 04-20-2005, 05:28 AM

sounds like a dos, time to call the system guy... oh and there is no log? even when its spoofed theres a log, you mean all 3000 resolve to nothing?

mensniche · 04-20-2005, 05:29 AM

We have had 2 system admins from cavecreek on it all night... banning ip's but more just keep coming

Could anyone do this or does it have the hallmarks of a known hacker?

DutchTeenCash · 04-20-2005, 05:31 AM

Quote:

Originally Posted by mensniche

We have had 2 system admins from cavecreek on it all night... banning ip's but more just keep coming

Could anyone do this or does it have the hallmarks of a known hacker?

anyone with a small linux server can do a DOS, so what do they do just 3000 ips asking for the index? a ded box gotta cope with that, must be something else, a large file theyre constantly dl?

alexg · 04-20-2005, 05:31 AM

yeah i noticed you were down a lot lately..
i hope you fix this quickly...

btw, are sales being tracked normally on all products during the downtime?

hydro · 04-20-2005, 05:37 AM

Maybe you sold some pills to a hacker and he got mad when they didnt work lol. Seriously that sucks though, lots of porn sites have been under attack lately

DutchTeenCash · 04-20-2005, 05:37 AM

what kinda ddos is it? there are like 3 basic ones, if its the simple version then adjusting the firewall to not let broadcast out is it, im sure cavecreek knows this stuff.

Forget bout tracking them if its a ddos, the attacks arent long enough and theyll end in some US uni or so...

mensniche · 04-20-2005, 05:43 AM

ayn flood atatck

pradaboy · 04-20-2005, 05:45 AM

we need Smokey in here... he's got mad skills!

Sorry to hear you're the target of some punk, maybe it's a jealous competitor.

Wizzo · 04-20-2005, 05:45 AM

Quote:

Originally Posted by mensniche

I have been told it would be

1) Competitor
2) Affiliate trying to improve sales
3) Non Affiliate trying to fuck one of our affiliates sales up!

I would bet money, it's none of the above except maybe #3, but more likely I would look for:

1) Ex-Affiliate that was canned for reasons that seem unjust to him.
2) Someone that got into a pissing match with on a board or where ever with anyone from your company.

hydro · 04-20-2005, 05:47 AM

Quote:

Originally Posted by mensniche

ayn flood atatck

syn flood?

frankfortuna · 04-20-2005, 05:47 AM

If you're running Apache, you may want to check out mod_dosevasive.

http://www.nuclearelephant.com/projects/dosevasive/

TurboAngel · 04-20-2005, 05:49 AM

Quote:

Originally Posted by pradaboy

we need Smokey in here... he's got mad skills!

He sure does.

mensniche · 04-20-2005, 05:49 AM

Quote:

Originally Posted by Wizzo

I would bet money, it's none of the above except maybe #3, but more likely I would look for:

1) Ex-Affiliate that was canned for reasons that seem unjust to him.
2) Someone that got into a pissing match with on a board or where ever with anyone from your company.

I think your more likley to be right

DutchTeenCash · 04-20-2005, 05:50 AM

Quote:

Originally Posted by hydro

syn flood?

thats a syn as far as I know yes, cc should be able to prevent that, thing is most if these guys dont want to start adjusting and filtering stuff...

pstation · 04-20-2005, 05:54 AM

Quote:

Originally Posted by frankfortuna

If you're running Apache, you may want to check out mod_dosevasive.

http://www.nuclearelephant.com/projects/dosevasive/

that wont do jack shit for a syn flood attack

try enabling TCP cookies, it will help a little bit

mensniche · 04-20-2005, 06:01 AM

anyone else... know who this may be?

pstation · 04-20-2005, 06:01 AM

you can always buy this

DutchTeenCash · 04-20-2005, 06:08 AM

Quote:

Originally Posted by pstation

you can always buy this

yeah and tons of other programs or hardware but thats not very helpfull right now...

anyone every used these guys ? http://www.block-ddos.com/about.php

pstation · 04-20-2005, 06:20 AM

If you're willing to move, pick up a server @ theplanet. Their DDoS filtering is pretty good, they did a great job filtering the 800mbit attack i was hit with a while back.

MickeyG · 04-20-2005, 06:23 AM

Im surprised cavecreek isn't more prepared to handle this sort of thing.

My guess is Wizzo is right its someone you guys pissed off.

DutchTeenCash · 04-20-2005, 06:25 AM

Quote:

Originally Posted by MickeyG

Im surprised cavecreek isn't more prepared to handle this sort of thing.

My guess is Wizzo is right its someone you guys pissed off.

yeah wonders me too, they can handle this im sure

mensniche · 04-20-2005, 06:25 AM

Quote:

Originally Posted by MickeyG

Im surprised cavecreek isn't more prepared to handle this sort of thing.

My guess is Wizzo is right its someone you guys pissed off.

Tell me about it... im not happy

Pete-KT · 04-20-2005, 06:26 AM

Maybe BradM finally got mad and attacked you ;)

mensniche · 04-20-2005, 06:26 AM

hahah no BradM is far to stupid... maybe he paid someone...

Richdude · 04-20-2005, 06:31 AM

I thought CaveCreek was top notch?

pstation · 04-20-2005, 06:34 AM

Quote:

Originally Posted by MickeyG

Im surprised cavecreek isn't more prepared to handle this sort of thing.

My guess is Wizzo is right its someone you guys pissed off.

it's rare to see hosting companies that can actively mitigate attacks, because the cost of it isnt usually justified

MickeyG · 04-20-2005, 06:50 AM

Quote:

Originally Posted by pstation

it's rare to see hosting companies that can actively mitigate attacks, because the cost of it isnt usually justified

I understand that, but cavecreek is no mom and pop shop over there. They have some HUGE clients.

mensniche · 04-20-2005, 07:15 AM

agreed...

FuqALot · 04-20-2005, 07:22 AM

The guy who is doing it is probably reading this. So stop it please. Thnx.

mensniche · 04-20-2005, 07:25 AM

Quote:

Originally Posted by FuqALot

The guy who is doing it is probably reading this. So stop it please. Thnx.

I wish he would contact me... I would love to know why!!

FuqALot · 04-20-2005, 07:25 AM

hey thinkx, the hosting you suggested is great indeed, ive never seen faster support hehe

BradM · 04-20-2005, 07:31 AM

Andy: We have been botnetted before... it's NOT pretty. Normally the people who do it are antis (people who hate spammers) but you guys don't take mail traffic, so I am at a loss of who it may be.

Gottis · 04-20-2005, 07:36 AM

Quote:

Originally Posted by mensniche

I wish he would contact me... I would love to know why!!

Sorry but why the hell would he want to get in touch with you and talk about it? Get real man, he's just trying to fuck your business/site up. Be it a competitor (then you know why he's doing it) or somebody who's bored to death over in Russia.

Who knows, you might get a blackmail letter soon.

mensniche · 04-20-2005, 07:46 AM

Maybe your right... maybe he wants to be paid off... but I suppose when your at the top people always want to take you down

CDSmith · 04-20-2005, 07:48 AM

Would these guys perhaps be able to help you?... http://www.pennywize.com/

DutchTeenCash · 04-20-2005, 07:49 AM

Quote:

Originally Posted by CDSmith

Would these guys perhaps be able to help you?... http://www.pennywize.com/

for brute force yes for ddos no

DutchTeenCash · 04-20-2005, 07:50 AM

Quote:

Originally Posted by FuqALot

hey thinkx, the hosting you suggested is great indeed, ive never seen faster support hehe

thanks appreciate the kind words, m3 is cool

exitmoney · 04-20-2005, 08:03 AM

mensniche , it sucks what happens. I guess you already have plans how to stop it but in case you need any of my personal experience this is what it could be and that happened to us before:

1) a webmaster that for any reason you canceled / terminated lately and that does not agree with your decission. Ex: spammer, carder, etc . Try to contact those people and see where it goes

2) In my case ISPRIME saved every time our attacks, without big impact, maybe you should give them a call and have one of their techs help you out or move your servers to them, they are the best.

Good luck with it.

sternyduke · 04-20-2005, 08:10 AM

smokey the bear can probably track them down....

Juicy D. Links · 04-20-2005, 08:19 AM

Its me , pay me 5 bottles of cock pills and ill stop

mensniche · 04-20-2005, 08:27 AM

Quote:

Originally Posted by sternyduke

smokey the bear can probably track them down....

get him to ICQ me

04-20-2005, 05:17 AM	#1
mensniche Confirmed User Join Date: Jun 2004 Location: UK Posts: 455	Anybody know who is attacking my network? We have been down for 10 hours + now due to some fuck hacking our servers, anybody know who might be doing this or why?? I have been told it would be 1) Competitor 2) Affiliate trying to improve sales 3) Non Affiliate trying to fuck one of our affiliates sales up! Any body know who to contact to get the fuck found? __________________ SIG TOO BIG! Maximum 120x60 button and no more than 3 text lines of DEFAULT SIZE and COLOR. Unless your sig is for a GFY top banner sponsor, you may use a 624x80 instead of a 120x60. Let me repeat... A 120 x 60 button and no more that 3 lines of DEFAULT SIZE AND COLOR text.

04-20-2005, 05:20 AM	#4
mensniche Confirmed User Join Date: Jun 2004 Location: UK Posts: 455	We have over 3000 IP's coming in so there using some major cloacking or bruat force __________________ SIG TOO BIG! Maximum 120x60 button and no more than 3 text lines of DEFAULT SIZE and COLOR. Unless your sig is for a GFY top banner sponsor, you may use a 624x80 instead of a 120x60. Let me repeat... A 120 x 60 button and no more that 3 lines of DEFAULT SIZE AND COLOR text.

04-20-2005, 05:21 AM	#5
mensniche Confirmed User Join Date: Jun 2004 Location: UK Posts: 455	yes loads - how come? __________________ SIG TOO BIG! Maximum 120x60 button and no more than 3 text lines of DEFAULT SIZE and COLOR. Unless your sig is for a GFY top banner sponsor, you may use a 624x80 instead of a 120x60. Let me repeat... A 120 x 60 button and no more that 3 lines of DEFAULT SIZE AND COLOR text.

04-20-2005, 05:22 AM	#7
Roald SecretFriends.com Industry Role: Join Date: May 2001 Location: IMC Headquarters Posts: 27,888	sorry I will stop hitting CTRL F5 on your sites. post some more info ;)) __________________ WE ARE BUYING PAY SITES! CONTACT ME ClubSweethearts \| ManUpFilms \| SinfulXXX \| HOT * AdultPrime * HOT Paying webmasters since 1996! Contact: r.riepen @ sansylgroup.com \| telegram: roaldr

04-20-2005, 05:25 AM	#9
Darren Confirmed User Join Date: Sep 2001 Posts: 5,994	IF you have experience with this, ICQ ANDY __________________ Penis enlargement / male enhancement pills - earn up to $229.48 per signup ICQ: 46335817

04-20-2005, 05:19 AM	#2
8 Characters So Fucking Banned Join Date: Jan 2005 Location: This month's character: Dirty Franck Posts: 2,336	1) or 3). Do you have someone available who speaks Romanian?

04-20-2005, 05:19 AM	#3
DutchTeenCash I like Dutch Girls Join Date: Feb 2003 Location: dutchteencash.com Posts: 21,684	you took a peek at the log right? whats the ip resolving to? __________________ ICQ 16 91 547 - SKYPE dutchteencash bob AT dutchteencash DOT com ... did you see our newest Sweet Natural Girl Priscilla (18)?

04-20-2005, 05:21 AM	#6
Dirty F Too lazy to set a custom title Industry Role: Join Date: Jul 2001 Posts: 59,204	Ya post some info here. Log files and stuff.

04-20-2005, 05:28 AM	#10
DutchTeenCash I like Dutch Girls Join Date: Feb 2003 Location: dutchteencash.com Posts: 21,684	sounds like a dos, time to call the system guy... oh and there is no log? even when its spoofed theres a log, you mean all 3000 resolve to nothing? __________________ ICQ 16 91 547 - SKYPE dutchteencash bob AT dutchteencash DOT com ... did you see our newest Sweet Natural Girl Priscilla (18)? Last edited by DutchTeenCash; 04-20-2005 at 05:29 AM..

04-20-2005, 05:29 AM	#11
mensniche Confirmed User Join Date: Jun 2004 Location: UK Posts: 455	We have had 2 system admins from cavecreek on it all night... banning ip's but more just keep coming Could anyone do this or does it have the hallmarks of a known hacker? __________________ SIG TOO BIG! Maximum 120x60 button and no more than 3 text lines of DEFAULT SIZE and COLOR. Unless your sig is for a GFY top banner sponsor, you may use a 624x80 instead of a 120x60. Let me repeat... A 120 x 60 button and no more that 3 lines of DEFAULT SIZE AND COLOR text.

04-20-2005, 05:31 AM	#13
alexg IL4L.com Join Date: Aug 2003 Location: Israel - ICQ: 162136565 Posts: 11,287	yeah i noticed you were down a lot lately.. i hope you fix this quickly... btw, are sales being tracked normally on all products during the downtime? __________________ Find fuck buddies in your area!

04-20-2005, 05:37 AM	#14
hydro Confirmed User Join Date: Dec 2003 Location: Dirty 3rd Posts: 4,216	Maybe you sold some pills to a hacker and he got mad when they didnt work lol. Seriously that sucks though, lots of porn sites have been under attack lately Last edited by hydro; 04-20-2005 at 05:38 AM..

04-20-2005, 05:43 AM	#16
mensniche Confirmed User Join Date: Jun 2004 Location: UK Posts: 455	ayn flood atatck __________________ SIG TOO BIG! Maximum 120x60 button and no more than 3 text lines of DEFAULT SIZE and COLOR. Unless your sig is for a GFY top banner sponsor, you may use a 624x80 instead of a 120x60. Let me repeat... A 120 x 60 button and no more that 3 lines of DEFAULT SIZE AND COLOR text.

04-20-2005, 05:45 AM	#17
pradaboy sell me your banners Industry Role: Join Date: Dec 2003 Location: on the tubes Posts: 12,931	we need Smokey in here... he's got mad skills! Sorry to hear you're the target of some punk, maybe it's a jealous competitor. __________________ Media Buyer - Sell me your traffic! FREE to register domains... Better than 99% of the crap sold here!

04-20-2005, 05:47 AM	#20
frankfortuna Confirmed User Join Date: Aug 2002 Posts: 1,504	If you're running Apache, you may want to check out mod_dosevasive. http://www.nuclearelephant.com/projects/dosevasive/

04-20-2005, 06:01 AM	#25
mensniche Confirmed User Join Date: Jun 2004 Location: UK Posts: 455	anyone else... know who this may be? __________________ SIG TOO BIG! Maximum 120x60 button and no more than 3 text lines of DEFAULT SIZE and COLOR. Unless your sig is for a GFY top banner sponsor, you may use a 624x80 instead of a 120x60. Let me repeat... A 120 x 60 button and no more that 3 lines of DEFAULT SIZE AND COLOR text.

04-20-2005, 06:01 AM	#26
pstation Confirmed User Join Date: Jul 2003 Location: chicago Posts: 1,135	you can always buy this

04-20-2005, 06:20 AM	#28
pstation Confirmed User Join Date: Jul 2003 Location: chicago Posts: 1,135	If you're willing to move, pick up a server @ theplanet. Their DDoS filtering is pretty good, they did a great job filtering the 800mbit attack i was hit with a while back.

04-20-2005, 06:23 AM	#29
MickeyG Confirmed User Join Date: May 2004 Location: South Florida Posts: 4,134	Im surprised cavecreek isn't more prepared to handle this sort of thing. My guess is Wizzo is right its someone you guys pissed off.

04-20-2005, 06:26 AM	#32
Pete-KT Workin With The Devil Industry Role: Join Date: Oct 2004 Location: West Bloomfield, MI Posts: 51,532	Maybe BradM finally got mad and attacked you ;)

04-20-2005, 06:31 AM	#34
Richdude Confirmed User Join Date: Feb 2005 Posts: 160	I thought CaveCreek was top notch?

04-20-2005, 07:15 AM	#37
mensniche Confirmed User Join Date: Jun 2004 Location: UK Posts: 455	agreed... __________________ SIG TOO BIG! Maximum 120x60 button and no more than 3 text lines of DEFAULT SIZE and COLOR. Unless your sig is for a GFY top banner sponsor, you may use a 624x80 instead of a 120x60. Let me repeat... A 120 x 60 button and no more that 3 lines of DEFAULT SIZE AND COLOR text.

04-20-2005, 07:22 AM	#38
FuqALot Confirmed User Join Date: Dec 2001 Location: Malibu Posts: 3,817	The guy who is doing it is probably reading this. So stop it please. Thnx.

04-20-2005, 07:25 AM	#40
FuqALot Confirmed User Join Date: Dec 2001 Location: Malibu Posts: 3,817	hey thinkx, the hosting you suggested is great indeed, ive never seen faster support hehe

04-20-2005, 07:31 AM	#41
BradM Confirmed User Join Date: Dec 2003 Location: 1123,6536,5231 Posts: 3,397	Andy: We have been botnetted before... it's NOT pretty. Normally the people who do it are antis (people who hate spammers) but you guys don't take mail traffic, so I am at a loss of who it may be.

04-20-2005, 07:46 AM	#43
mensniche Confirmed User Join Date: Jun 2004 Location: UK Posts: 455	Maybe your right... maybe he wants to be paid off... but I suppose when your at the top people always want to take you down __________________ SIG TOO BIG! Maximum 120x60 button and no more than 3 text lines of DEFAULT SIZE and COLOR. Unless your sig is for a GFY top banner sponsor, you may use a 624x80 instead of a 120x60. Let me repeat... A 120 x 60 button and no more that 3 lines of DEFAULT SIZE AND COLOR text.

04-20-2005, 07:48 AM	#44
CDSmith Too lazy to set a custom title Industry Role: Join Date: May 2001 Location: My network is hosted at TECHIEMEDIA.net ...Wait, you meant where am I located at? Oh... okay, I'm in Winnipeg, Canada. Oops. :) Posts: 51,460	Would these guys perhaps be able to help you?... http://www.pennywize.com/ __________________ *Promote Wildmatch, ImLive, Sexier.com, and more!!* ALWAYS THE HIGHEST PAYOUTS: Big Bux/ImLive SIGNUP ON NOW!!! Put some PUSSYCA$H in your pocket. ICQ me at: 31024634

04-20-2005, 08:03 AM	#47
exitmoney Confirmed User Join Date: Apr 2002 Location: montreal, canada Posts: 143	mensniche , it sucks what happens. I guess you already have plans how to stop it but in case you need any of my personal experience this is what it could be and that happened to us before: 1) a webmaster that for any reason you canceled / terminated lately and that does not agree with your decission. Ex: spammer, carder, etc . Try to contact those people and see where it goes 2) In my case ISPRIME saved every time our attacks, without big impact, maybe you should give them a call and have one of their techs help you out or move your servers to them, they are the best. Good luck with it.

04-20-2005, 08:10 AM	#48
sternyduke Confirmed User Join Date: Jun 2001 Location: scottsdale Posts: 1,082	smokey the bear can probably track them down....

04-20-2005, 08:19 AM	#49
Juicy D. Links So Fucking Banned Industry Role: Join Date: Apr 2001 Location: N.Y. -Long Island -- Posts: 122,992	Its me , pay me 5 bottles of cock pills and ill stop