Skip to main content
Information Security

Return to Question

Bumped by Community user
Bumped by Community user
Bumped by Community user
Bumped by Community user
Bumped by Community user
grammar/wording/spelling
Source Link
edit approved Dec 30, 2018 at 2:34
guntbert
edit approved Dec 30, 2018 at 2:34
guntbert
  • 2k
  • 2
  • 18
  • 21

Website is behaving strangely after an attack- was it attacked?

Our website wasswas behaving strangely. Sometime it was down and nothing was accessible. Sometime it started loading but pages browsing was too slow.

  • Sometime it was down and nothing was accessible.
  • Sometime it started loading but pages browsing was too slow.

We checked apache logs and found the below suspicious entries:

Our quick backup response was to block these client IPSIP-addresses

Detail about above log entry: https://www.abuseipdb.com/check/91.121.134.18?page=2#report. We also blocked these IPSIP-addresses

I want to know what was going on? Was it a DDOS attack or something else? For now I have blocked the suspicious IPs however.

However what is the permanent solutions/tricks to limit/end these type of attacks?

Website is behaving strangely after an attack?

Our website wass behaving strangely. Sometime it was down and nothing was accessible. Sometime it started loading but pages browsing was too slow. We checked apache logs and found the below suspicious entries:

Our quick backup response was to block these client IPS

Detail about above log entry: https://www.abuseipdb.com/check/91.121.134.18?page=2#report. We also blocked these IPS

I want to know what was going on? Was it DDOS attack or something else? For now I have blocked the suspicious IPs however what is the permanent solutions/tricks to limit/end these type of attacks?

Website is behaving strangely - was it attacked?

Our website was behaving strangely.

  • Sometime it was down and nothing was accessible.
  • Sometime it started loading but pages browsing was too slow.

We checked apache logs and found the below suspicious entries:

Our quick backup response was to block these IP-addresses

Detail about above log entry: https://www.abuseipdb.com/check/91.121.134.18?page=2#report. We also blocked these IP-addresses

I want to know what was going on? Was it a DDOS attack or something else? For now I have blocked the suspicious IPs.

However what is the permanent solutions/tricks to limit/end these type of attacks?

Source Link
Iftikhar uddin
Iftikhar uddin
  • 111
  • 2

Website is behaving strangely after an attack?

Our website wass behaving strangely. Sometime it was down and nothing was accessible. Sometime it started loading but pages browsing was too slow. We checked apache logs and found the below suspicious entries:

[Fri Dec 28 00:47:47 2018] [error] [client 212.237.1.209] File does not exist: /usr/share/phpMyAdmin/css
[Fri Dec 28 00:47:47 2018] [error] [client 212.237.1.209] script '/usr/share/phpMyAdmin/config.user.inc.php' not found or unable to stat
[Fri Dec 28 00:47:47 2018] [error] [client 212.237.1.209] script '/usr/share/phpMyAdmin/config_inf.php' not found or unable to stat
[Fri Dec 28 00:47:47 2018] [error] [client 212.237.1.209] File does not exist: /usr/share/phpMyAdmin/4.2
[Fri Dec 28 00:47:48 2018] [error] [client 212.237.1.209] File does not exist: /usr/share/phpMyAdmin/scripts
[Fri Dec 28 00:47:48 2018] [error] [client 212.237.1.209] File does not exist: /usr/share/phpMyAdmin/config
[Fri Dec 28 00:47:48 2018] [error] [client 212.237.1.209] File does not exist: /usr/share/phpMyAdmin/scripts
[Fri Dec 28 00:47:48 2018] [error] [client 212.237.1.209] File does not exist: /usr/share/phpMyAdmin/config
[Fri Dec 28 01:03:28 2018] [error] [client 115.159.111.47] File does not exist: /usr/share/phpMyAdmin/scripts
[Fri Dec 28 01:03:28 2018] [error] [client 115.159.111.47] File does not exist: /usr/share/phpMyAdmin/scripts
[Fri Dec 28 01:03:28 2018] [error] [client 115.159.111.47] File does not exist: /usr/share/phpMyAdmin/scripts
[Fri Dec 28 01:03:28 2018] [error] [client 115.159.111.47] File does not exist: /usr/share/phpMyAdmin/scripts

Our quick backup response was to block these client IPS

Moreover we also found the below entries in logs:

[Mon Dec 24 07:17:26 2018] [error] [client 91.121.134.18] Empty module and/or action after parsing the URL "/api/ip.php" (/).

Detail about above log entry: https://www.abuseipdb.com/check/91.121.134.18?page=2#report. We also blocked these IPS

I want to know what was going on? Was it DDOS attack or something else? For now I have blocked the suspicious IPs however what is the permanent solutions/tricks to limit/end these type of attacks?