Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links


Categories

In this Discussion

› › Suspicious Activity From Server
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

Suspicious Activity From Server

HostMayoHostMayo Member, Host Rep
in Help

I have a server with cpanel installed only. My ip is being null routed by the data center owing to a suspicious activity. They say that Server was targetting for an attack.

"Incoming: grand 2020-02-19 09:28:25 PM 63.141.238.162 -> 134,349 PPS for 5 seconds (ntp)"

Can any one suggest me how to counter this issue.

Log:

in: 173.208.255.5 63.141.238.162:80 - 190.2.208.37:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.36:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 162.243.124.239:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 118.98.104.26:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.75:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.74:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 45.55.189.179:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.75:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.76:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 101.89.147.213:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 120.52.146.12:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 76.96.15.226:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 101.89.147.213:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 199.203.55.10:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 162.243.124.239:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.37:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 76.96.15.226:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.76:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 34.94.234.134:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.75:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 118.98.104.26:123 UDP
in: 173.208.255.5 63.141.238.162:0 - 202.55.175.253:11 ICMP
in: 173.208.255.5 63.141.238.162:80 - 185.179.250.199:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.36:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 5.227.187.86:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 45.55.189.179:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 197.255.238.253:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 106.12.241.104:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 186.224.130.107:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 197.255.238.253:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 120.52.146.12:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 185.179.250.199:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 197.255.238.253:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 185.179.250.199:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.75:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 185.179.250.199:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 120.52.146.12:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.37:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 118.98.104.26:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.36:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 162.243.124.239:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 197.255.238.253:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.36:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 118.98.104.26:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.75:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 197.255.238.253:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 34.94.234.134:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 222.143.1.116:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 106.12.241.104:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 120.52.146.12:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 35.203.31.84:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 162.243.124.239:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 162.243.124.239:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.76:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 76.96.15.226:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 185.147.24.198:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 185.147.24.198:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 34.94.234.134:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 175.23.185.46:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.75:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 120.52.146.12:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 120.52.146.12:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.76:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 185.179.250.199:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 31.170.236.136:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.75:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 222.143.1.116:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 34.67.79.96:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 34.67.79.96:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 35.203.31.84:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 35.203.31.84:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 76.96.15.227:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 31.170.236.136:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.74:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 81.40.234.28:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 101.89.147.213:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 34.67.79.96:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 76.96.15.227:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 76.96.15.226:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.74:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 76.96.15.226:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 185.179.250.199:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 197.255.238.253:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 118.98.104.26:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 199.203.55.10:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 197.255.238.253:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.76:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 199.203.55.10:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.75:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.76:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.75:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 185.147.24.198:123 UDP
in: 173.208.255.5 63.141.238.162:0 - 202.55.175.253:11 ICMP
in: 173.208.255.5 63.141.238.162:80 - 162.243.124.239:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 197.255.238.253:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 185.179.250.199:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 186.224.130.107:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 186.224.130.107:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 45.55.189.179:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 222.143.1.116:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 35.203.31.84:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 35.203.31.84:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 119.188.35.84:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 185.147.24.198:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 101.89.147.213:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.76:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 41.226.21.42:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.36:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 218.75.112.198:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 31.170.236.136:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 41.226.21.42:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 197.255.238.253:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.76:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 34.67.79.96:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 118.98.104.26:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 185.179.250.199:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 185.179.250.199:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 197.255.238.253:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 35.203.31.84:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 101.89.147.213:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 106.12.241.104:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 106.12.241.104:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 185.179.250.199:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 31.170.236.136:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 162.243.124.239:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 31.170.236.136:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 139.217.218.4:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 162.243.124.239:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 35.203.31.84:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 167.114.66.114:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 45.55.189.179:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 167.114.66.114:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 34.94.234.134:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 222.143.1.116:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 5.227.187.86:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 185.179.250.199:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 69.162.74.202:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 45.55.189.179:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 175.23.185.46:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 101.89.147.213:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 35.203.31.84:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 35.203.31.84:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 198.245.51.184:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.37:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 118.98.104.26:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 35.203.31.84:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 45.55.189.179:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.37:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 119.188.35.84:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 45.55.189.179:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 119.188.35.84:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 45.55.189.179:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 101.89.147.213:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 31.170.236.136:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 101.89.147.213:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 34.94.234.134:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 106.12.241.104:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 5.227.187.86:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 185.147.24.198:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 35.203.31.84:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 222.143.1.116:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 198.245.51.184:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 218.75.112.198:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 218.75.112.198:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.37:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 222.143.1.116:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.36:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 45.55.189.179:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 34.94.234.134:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 199.203.55.10:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 199.203.55.10:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 45.55.189.179:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.76:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 76.96.15.226:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 76.96.15.226:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 120.52.146.12:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 101.89.147.213:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 197.255.238.253:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 34.94.234.134:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 162.243.124.239:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.75:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 185.147.24.198:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 222.143.1.116:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 35.203.31.84:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 118.98.104.26:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 120.52.146.12:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 222.143.1.116:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 45.55.189.179:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 197.255.238.253:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 34.67.79.96:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 34.67.79.96:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 34.94.234.134:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 41.226.21.42:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 45.55.189.179:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 34.67.79.96:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.76:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 45.55.189.179:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 114.116.236.20:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.76:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.37:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 45.55.189.179:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 119.188.35.84:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 76.96.15.227:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 185.179.250.199:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 162.243.124.239:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 120.52.146.12:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 185.147.24.198:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 120.52.146.12:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 190.2.208.74:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 31.170.236.136:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 101.89.147.213:123 UDP
in: 173.208.255.5 63.141.238.162:80 - 162.243.124.239:123 UDP

Comments

  • IonSwitch_StanIonSwitch_Stan Member, Host Rep
    edited February 2020

    Can any one suggest me how to counter this issue.

    Wait it out, ask whomever is DDoSing you politely to stop, or move to a provider with DDOS protection. Presumably you are hosting a site that made someone upset. Why are there three IP's listed on each row? (Wholesale Internet, and Fbivps, and presumably an attacker).

  • ManalManal Member

    I can understand your frustration. Someone used NTP amplification against your server.

  • HostMayoHostMayo Member, Host Rep

    @IonSwitch_Stan said: the third ip is from China. But I recently disabed an account of client from Japan. He had phising site. But his cpanel account was disabled. Wonder how can I locate the actual person behind this.
    @Manal thanks for atlease pointing me in the right direction. What options do I have here going for ddos protected servers only? Let me also google for mitigating NTP attacks.

  • ManalManal Member

    To prevent NTP Reflection, close port UDP output 123.
    This will, however, stop time synchronization via the "ntpdate" command.
    You can use "rdate" instead of "ntpdate" which uses port 37.

    Google "How to stop NTP reflection in cPanel" and you may find more info.

    Thanked by 1HostMayo
  • marvelmarvel Member

    @Manal said:
    To prevent NTP Reflection, close port UDP output 123.
    This will, however, stop time synchronization via the "ntpdate" command.
    You can use "rdate" instead of "ntpdate" which uses port 37.

    Google "How to stop NTP reflection in cPanel" and you may find more info.

    His attack is incoming. He's being attacked by NTP servers so this won't help.

    You should change your IP if possible and then hide it behind Cloudflare. This won't help though when you provide FTP/SSH access as customers would still need the origin IP.

    Thanked by 1HostMayo
  • joepie91joepie91 Member, Patron Provider

    @marvel said:

    @Manal said:
    To prevent NTP Reflection, close port UDP output 123.
    This will, however, stop time synchronization via the "ntpdate" command.
    You can use "rdate" instead of "ntpdate" which uses port 37.

    Google "How to stop NTP reflection in cPanel" and you may find more info.

    His attack is incoming. He's being attacked by NTP servers so this won't help.

    You should change your IP if possible and then hide it behind Cloudflare. This won't help though when you provide FTP/SSH access as customers would still need the origin IP.

    This is not a reliable method. It's not that difficult to find the IP behind a Cloudflare thing, if you're a little motivated. If you're getting hit with DDoS attacks, what you need is proper network-level mitigation (either offered by the provider, like with OVH/Ramnode/BuyVM/etc., or through a third-party provider).

  • marvelmarvel Member

    @joepie91 said:

    @marvel said:

    @Manal said:
    To prevent NTP Reflection, close port UDP output 123.
    This will, however, stop time synchronization via the "ntpdate" command.
    You can use "rdate" instead of "ntpdate" which uses port 37.

    Google "How to stop NTP reflection in cPanel" and you may find more info.

    His attack is incoming. He's being attacked by NTP servers so this won't help.

    You should change your IP if possible and then hide it behind Cloudflare. This won't help though when you provide FTP/SSH access as customers would still need the origin IP.

    This is not a reliable method. It's not that difficult to find the IP behind a Cloudflare thing, if you're a little motivated. If you're getting hit with DDoS attacks, what you need is proper network-level mitigation (either offered by the provider, like with OVH/Ramnode/BuyVM/etc., or through a third-party provider).

    It is in fact quite difficult if you don't have any DNS records pointing to the origin IP. Besides that if you use Cloudflare you can block direct port 80/443 connections and only allow them from Cloudflare's network. So any packets aiming at your direct IP will hit a brick wall, unless they fill up your available bandwidth of course or cause a blackhole of your IP.

    OVH/BuyVM etc only offer Layer 3/4 mitigation but it's still relatively easy to down someone's website using a Layer 7 attack. If you run Cloudflare it can mitigate that as well, but I agree you need some service to initially protect yourself against L3/4.

    Thanked by 1donko
  • ManalManal Member

    @marvel said:

    @joepie91 said:

    @marvel said:

    @Manal said:
    To prevent NTP Reflection, close port UDP output 123.
    This will, however, stop time synchronization via the "ntpdate" command.
    You can use "rdate" instead of "ntpdate" which uses port 37.

    Google "How to stop NTP reflection in cPanel" and you may find more info.

    His attack is incoming. He's being attacked by NTP servers so this won't help.

    You should change your IP if possible and then hide it behind Cloudflare. This won't help though when you provide FTP/SSH access as customers would still need the origin IP.

    This is not a reliable method. It's not that difficult to find the IP behind a Cloudflare thing, if you're a little motivated. If you're getting hit with DDoS attacks, what you need is proper network-level mitigation (either offered by the provider, like with OVH/Ramnode/BuyVM/etc., or through a third-party provider).

    It is in fact quite difficult if you don't have any DNS records pointing to the origin IP. Besides that if you use Cloudflare you can block direct port 80/443 connections and only allow them from Cloudflare's network. So any packets aiming at your direct IP will hit a brick wall, unless they fill up your available bandwidth of course or cause a blackhole of your IP.

    OVH/BuyVM etc only offer Layer 3/4 mitigation but it's still relatively easy to down someone's website using a Layer 7 attack. If you run Cloudflare it can mitigate that as well, but I agree you need some service to initially protect yourself against L3/4.

    A combination of OVH + Cloudflare + UAM in CF will make it almost impossible for hackers to take down your site(unless they find other methods).

    Thanked by 1marvel
  • marvelmarvel Member

    @Manal said:

    @marvel said:

    @joepie91 said:

    @marvel said:

    @Manal said:
    To prevent NTP Reflection, close port UDP output 123.
    This will, however, stop time synchronization via the "ntpdate" command.
    You can use "rdate" instead of "ntpdate" which uses port 37.

    Google "How to stop NTP reflection in cPanel" and you may find more info.

    His attack is incoming. He's being attacked by NTP servers so this won't help.

    You should change your IP if possible and then hide it behind Cloudflare. This won't help though when you provide FTP/SSH access as customers would still need the origin IP.

    This is not a reliable method. It's not that difficult to find the IP behind a Cloudflare thing, if you're a little motivated. If you're getting hit with DDoS attacks, what you need is proper network-level mitigation (either offered by the provider, like with OVH/Ramnode/BuyVM/etc., or through a third-party provider).

    It is in fact quite difficult if you don't have any DNS records pointing to the origin IP. Besides that if you use Cloudflare you can block direct port 80/443 connections and only allow them from Cloudflare's network. So any packets aiming at your direct IP will hit a brick wall, unless they fill up your available bandwidth of course or cause a blackhole of your IP.

    OVH/BuyVM etc only offer Layer 3/4 mitigation but it's still relatively easy to down someone's website using a Layer 7 attack. If you run Cloudflare it can mitigate that as well, but I agree you need some service to initially protect yourself against L3/4.

    A combination of OVH + Cloudflare + UAM in CF will make it almost impossible for hackers to take down your site(unless they find other methods).

    I agree only I hate that UAM 'Checking your browser' screen. Especially on WHT it's looping sometimes and you get it with every link you click.

  • sirluissirluis Member

    We can't go on together with suspicious minds

    Thanked by 1uptime
  • HostMayoHostMayo Member, Host Rep

    The WSI doesn't provide any sort of ddos mitigation. I activated few of the options related to ddos in CSF like SYNFLOOD, PORTFlood, UDPFlood, distrubution ip attack etc. The attack seems to be stopped or may be the attacker got something better to do and left himself. Anyway thanks for all the support.
    @marvel just one question if attack is incoming wouldn't blocking a specific port or ip help?

  • marvelmarvel Member

    @Waqass yes you could block incoming 123 but that will kill your ntp time sync. Unless you have multiple IPs which is recommended anyway, so run your system on one IP, and run your websites on another so you can do specific filtering.

    But it's all pointless if the attack is saturating your bandwidth, you can block it but the packets already reached your server so you're too late. With OVH you can block it on their firewall, so before it reaches your server.

    Luckily though most attackers get bored pretty quickly which seems the case with you as well, but sometimes you have a more persistent fellow. It's def. not bad to think about getting better protection for the future.

    Thanked by 1HostMayo
  • AK_KWHAK_KWH Member, Patron Provider

    To be safe in future just make ur task to regularly scan your server to be safe from abuse use maldet scanner to scan your server on daily basis switch to ddos protected server provider or else just sit and enjoy

  • HostMayoHostMayo Member, Host Rep

    @Manal @marvel blocking port 123 didn't helped. I even installed BitNinja application and enabled their all modules but all in vain. The attacker again seem to caught me. Upon my inquiry with provider that my port is already blocked here what I got

    UDP/123 is the port the attack sources are using. As indicated by the flows, UDP/80 is the target port.
    These attacks are being seen at 200-300kpps, and are still being seen at this moment. We will try to remove the nullroute in an hour to see if the attacks have passed

  • jugganutsjugganuts Member

    Best wishes I know what a headache and frustration this can cause, bit look at it as a good learning experiences.

  • marvelmarvel Member

    @Waqass said:
    @Manal @marvel blocking port 123 didn't helped. I even installed BitNinja application and enabled their all modules but all in vain. The attacker again seem to caught me. Upon my inquiry with provider that my port is already blocked here what I got

    UDP/123 is the port the attack sources are using. As indicated by the flows, UDP/80 is the target port.
    These attacks are being seen at 200-300kpps, and are still being seen at this moment. We will try to remove the nullroute in an hour to see if the attacks have passed

    Yeah nullrouting sucks. Get an OVH or Voxility server.

  • naturalnatural Member

    ex-girlfriend ?

  • HostMayoHostMayo Member, Host Rep

    @jugganuts yeah totally new experience of frustration :expressionless:
    Anyways has anybody experience of running customer cpanel server behind cloudflares ip? Will it cause any issue to my client as I will be providing them my name server which will be pointing towards the cloudflare :confused:

Sign In or Register to comment.