• Shoutbox
    Active Users: 0
     
  • Notice: N/A
    Loading...
 
  • Active Users
     
  • There are currently no users chatting.
 
Page 1 of 2 12 LastLast
Results 1 to 10 of 17
  1. #1
    Administrator heatsinkbod's Avatar
    Join Date
    Jul 2016
    Location
    Chester
    Posts
    238
    Trophies
    Blog Entries
    2

    Request IP to be blocked on AAAA Hosting

    Hi all ok seems to have been a few issues with attacks on AAAA Hosted servers so on this thread you can now request the following -:

    1.Present copy and paste of server log of the attack IE getsatus via web console or log
    2.Provide IP and port
    3.We will then investigate attack

    DO NOT request ban because of cheating !!!! - thats impossible for us to police so this is for attacks only

  2. #2
    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 63.142.70.205:-7314 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    http://geoiplookup.net/ip/156.203.68.70

    I am banning manually these flood ip's yet i don't know if when i ban the ip it bans to all the other ports (servers) from AAAA IP (109.70.148.92).

    If it does that would be awesome because WE server admins can ban through console with GSprotection.
    Last edited by PacRac; 09-16-2016 at 02:33 AM.

  3. #3
    Administrator heatsinkbod's Avatar
    Join Date
    Jul 2016
    Location
    Chester
    Posts
    238
    Trophies
    Blog Entries
    2
    Quote Originally Posted by PacRac View Post
    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 63.142.70.205:-7314 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    SV packet 156.203.68.70:3464 : getstatus

    http://geoiplookup.net/ip/156.203.68.70

    I am banning manually these flood ip's yet i don't know if when i ban the ip it bans to all the other ports (servers) from AAAA IP (109.70.148.92).

    If it does that would be awesome because WE server admins can ban through console with GSprotection.
    Hi getstatus seems to imply it will block via firewall via the firewall flag in config but have checked firewall rules and cant see any new ones added so thats a shame will have another read of gsprotector docs as may be the netsh command is incorrect for windows 2008

    have manually added those ips to the firewall thanks for reporting

  4. #4
    SV packet 77.106.140.4:7130 : getstatus

    SV packet 156.202.135.35:19295 : getstatus

    SV packet 77.106.140.4:7130 : getstatus

    SV packet 77.106.140.4:7130 : getstatus

    SV packet 156.202.135.35:19295 : getstatus

    SV packet 77.106.140.4:7130 : getstatus

    SV packet 156.202.135.35:19295 : getstatus

  5. #5
    Administrator heatsinkbod's Avatar
    Join Date
    Jul 2016
    Location
    Chester
    Posts
    238
    Trophies
    Blog Entries
    2
    Quote Originally Posted by PacRac View Post
    SV packet 77.106.140.4:7130 : getstatus

    SV packet 156.202.135.35:19295 : getstatus

    SV packet 77.106.140.4:7130 : getstatus

    SV packet 77.106.140.4:7130 : getstatus

    SV packet 156.202.135.35:19295 : getstatus

    SV packet 77.106.140.4:7130 : getstatus

    SV packet 156.202.135.35:19295 : getstatus
    Ok those added

  6. #6
    Are these IPs continuously doing it though? Cause I just see a few lines, and it could have legit reasons.
    Just wondering if it really spams the logs hundreds of times or not haha (I totally get that you wouldn't want to post the entire logs due to the size, I'm just curious ^^).

  7. #7
    Administrator heatsinkbod's Avatar
    Join Date
    Jul 2016
    Location
    Chester
    Posts
    238
    Trophies
    Blog Entries
    2
    Quote Originally Posted by Shadow View Post
    Are these IPs continuously doing it though? Cause I just see a few lines, and it could have legit reasons.
    Just wondering if it really spams the logs hundreds of times or not haha (I totally get that you wouldn't want to post the entire logs due to the size, I'm just curious ^^).
    Well I case of fire fighting at present but yeh getstatus uses normal so yeh possible null attacks also and normal getstatus requests........... We have only banned about 13 ip's so far

  8. #8
    Lol obvious it was continuous if i paste all the log you would never get to see the quick reply button for a day DDD

  9. #9
    Administrator Major_A's Avatar
    Join Date
    Jul 2016
    Location
    Huntington, IN USA
    Posts
    391
    Trophies
    Blog Entries
    15
    I have a question.
    Where are the IP's originating from?
    I'm only curious as alot of time when forum says 9 users online, alot of them say Baiduspider and is a Chinese webcrawler from what I can tell.

    Not blaming Chinese or anything just asking as you gents know more on the subject and there always seems to be crawlers hitting the forums.

    And on that note, I was curious if forums and servers are separate entities, or in different places?



  10. #10
    Administrator heatsinkbod's Avatar
    Join Date
    Jul 2016
    Location
    Chester
    Posts
    238
    Trophies
    Blog Entries
    2
    Quote Originally Posted by Major_A View Post
    I have a question.
    Where are the IP's originating from?
    I'm only curious as alot of time when forum says 9 users online, alot of them say Baiduspider and is a Chinese webcrawler from what I can tell.

    Not blaming Chinese or anything just asking as you gents know more on the subject and there always seems to be crawlers hitting the forums.

    And on that note, I was curious if forums and servers are separate entities, or in different places?
    From all over the place by the looks - Website on same server - so far no attacks on website

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •