HAZI.ro | ALL LXC containers suspended

FlorinMarian

Hello everyone!
After thinking that we saw them all, today someone showed us the opposite.
Without hesitating too much to tell the truth, after we were very close to losing the IP / 24 class because of a client who owned porn movies with children, this time someone took it to the next level, using our primary IP to it scans different servers, being impossible to detect (it does not scan many servers in parallel but "squeezes" them one by one).
It is a very bad time when I will be missing 24 hours of online life but when I return I will set up an OVH tunnel through which all clients will be able to recover their files before their servers are canceled.
I'm very sorry that he got here, but believe me, it's not at all OK to lose a few thousand euros for a kid who makes fun of our work and our time.

There are two options:

• refund of money in the client's account
• refund of money via paypal, regardless of the payment method chosen
• use IPv6 only
• pay 1 eur/month for dedicated IPv4

We also mention that this was the first and last time we provided NAT VPSs.

Sincerely, Florin.

marian

@FlorinMarian said: a client who owned porn movies with children

this is some pretty wild shit and should be reported to the police. you have reported it, right?

Murv

Guess what, I'm affected by this as well...
I thought I could get away from LET drama and relax for a while. But somehow I get dragged into them each time...

@FlorinMarian said: There are two options:

How about offering a dedicated IPv4 (for a certain price) instead of the NAT IP for those people who want to keep their servers?

FlorinMarian

@Murv said:
Guess what, I'm affected by this as well...
I thought I could get away from LET drama and relax for a while. But somehow I get dragged into them each time...

@FlorinMarian said: There are two options:

How about offering a dedicated IPv4 (for a certain price) instead of the NAT IP for those people who want to keep their servers?

Package itself is 6 eur per year and IPv4 is 12 eur/year, isn't a fesable solution for this customer range.

hzhoanglee

I'm currently using it for my backup purpose, which is really good. So sad to hear this

Neoon

http://www.pmacct.net makes a lot of stuff possible.
Especially port scan detection outbound.

Murv

@FlorinMarian said: Package itself is 6 eur per year and IPv4 is 12 eur/year, isn't a fesable solution for this customer range.

I personally wouldn't mind paying 12EUR/yr extra for an IP. It'd still be a pretty good deal.
Another option would be IPv6 only. You could get rid of the NAT IPv4 altogether.

@FlorinMarian said: a client who owned porn movies with children

@FlorinMarian said: using our primary IP to it scans different servers

If people spent their worthless time watching anime instead of doing creepy shit like this, humanity would suck less...

FlorinMarian

@Neoon said:
http://www.pmacct.net makes a lot of stuff possible.
Especially port scan detection outbound.

Thank you for support but unfortunatelly it's too late for us.
Next time RIPE itself will be on email CC and that will mean not "the end is nigh" but "the end is now".

If someone is happy with IPv6 only, no problem. We can do that.
Best regards, Florin.

hzhoanglee

@FlorinMarian said: If someone is happy with IPv6 only, no problem. We can do that.

Do you have any lowend IPv4 Class :d

noaman

@FlorinMarian said:

@Neoon said:
http://www.pmacct.net makes a lot of stuff possible.
Especially port scan detection outbound.

Thank you for support but unfortunatelly it's too late for us.
Next time RIPE itself will be on email CC and that will mean not "the end is nigh" but "the end is now".

If someone is happy with IPv6 only, no problem. We can do that.
Best regards, Florin.

IPv6 would work but I believe the IPV6 used is from hurricane electric and I think its blocking CF (Could be wrong though)

FlorinMarian

@noaman said:

@FlorinMarian said:

@Neoon said:
http://www.pmacct.net makes a lot of stuff possible.
Especially port scan detection outbound.

Thank you for support but unfortunatelly it's too late for us.
Next time RIPE itself will be on email CC and that will mean not "the end is nigh" but "the end is now".

If someone is happy with IPv6 only, no problem. We can do that.
Best regards, Florin.

IPv6 would work but I believe the IPV6 used is from hurricane electric and I think its blocking CF (Could be wrong though)

Nope, you're right. It is HE IPv6.
Thank you for support!

ezeth

And this is why you don't accept crypto.

Just do like me.

Force 3D secure on credit card, and only accept credit card. Literally no fraud or abuse for that matter

Want to take it one step further? Not required but sure
https://stripe.com/identity

noaman

@FlorinMarian said:

@noaman said:

@FlorinMarian said:

@Neoon said:
http://www.pmacct.net makes a lot of stuff possible.
Especially port scan detection outbound.

Thank you for support but unfortunatelly it's too late for us.
Next time RIPE itself will be on email CC and that will mean not "the end is nigh" but "the end is now".

If someone is happy with IPv6 only, no problem. We can do that.
Best regards, Florin.

IPv6 would work but I believe the IPV6 used is from hurricane electric and I think its blocking CF (Could be wrong though)

Nope, you're right. It is HE IPv6.
Thank you for support!

Is it possible to have just SSH connectivity using IPv4? ( Block all outgoing traffic on the IPV4 at firewall and just allow incoming SSH traffic)

At least I could access my box as we don't have native ipv6 over here

FlorinMarian

@ezeth said:
And this is why you don't accept crypto.

Just do like me.

Force 3D secure on credit card, and only accept credit card. Literally no fraud or abuse for that matter

Thank you for feedback dear brother but even CC doesn't help with this kind of situation because I have absolutelly no idea who's behind this sh*t.

FlorinMarian

@noaman said:

@FlorinMarian said:

@noaman said:

@FlorinMarian said:

@Neoon said:
http://www.pmacct.net makes a lot of stuff possible.
Especially port scan detection outbound.

Thank you for support but unfortunatelly it's too late for us.
Next time RIPE itself will be on email CC and that will mean not "the end is nigh" but "the end is now".

If someone is happy with IPv6 only, no problem. We can do that.
Best regards, Florin.

IPv6 would work but I believe the IPV6 used is from hurricane electric and I think its blocking CF (Could be wrong though)

Nope, you're right. It is HE IPv6.
Thank you for support!

Is it possible to have just SSH connectivity using IPv4? ( Block all outgoing traffic on the IPV4 at firewall and just allow incoming SSH traffic)

At least I could access my box as we don't have native ipv6 over here

It is impossible to do this because attacker didn't bindeed any port on his port range but he was treated as a client who got a random port from main server ( like 53xxx)
Best regards, Florin.

ascicode

@ezeth said:
And this is why you don't accept crypto.

Just do like me.

Force 3D secure on credit card, and only accept credit card. Literally no fraud or abuse for that matter

Want to take it one step further? Not required but sure
https://stripe.com/identity

This wont stop anyone to abuse the system.

ezeth

@ascicode said:

@ezeth said:
And this is why you don't accept crypto.

Just do like me.

Force 3D secure on credit card, and only accept credit card. Literally no fraud or abuse for that matter

Want to take it one step further? Not required but sure
https://stripe.com/identity

This wont stop anyone to abuse the system.

Just from personal experience. Over 1k unique clients, no fraud, not a single abuse report in over 6 months.

Here are the most effective stripe rules:

Force 3d secure - literally they have to verify with 3d secure or they cannot proceed. If they do this you know that the card holder is the one who ordered and then they won't do anything fishy because you got their real name, address etc.

block if :is_anonymous_ip: - blocks all VPNs etc

:ip_country: != :card_country: - blocks all payments where IP is not equal to where the card was issued

and finally, block all prepaid cards, anonymous cards etc

Murv

@ezeth said: Literally no fraud or abuse for that matter

And no genuine customers who can't pay with PayPal or Visa/MasterCard...

@FlorinMarian said: If someone is happy with IPv6 only, no problem. We can do that.

IPv6 only is definitely better than no service.
HE IPv6 is a bit annoying, as it does block CloudFlare. But still that's better than nothing...

ezeth

@Murv said: And no genuine customers who can't pay with PayPal or Visa/MasterCard...

you can also have ACH bank wire. Here you can have similar rules

If customer in question does not have a bank account, or a debit/credit card then I think its best to not service this customer as its too high risk

ascicode

@ezeth said:

@ascicode said:

@ezeth said:
And this is why you don't accept crypto.

Just do like me.

Force 3D secure on credit card, and only accept credit card. Literally no fraud or abuse for that matter

Want to take it one step further? Not required but sure
https://stripe.com/identity

This wont stop anyone to abuse the system.

Just from personal experience. Over 1k unique clients, no fraud, not a single abuse report in over 6 months.

Here are the most effective stripe rules:

Force 3d secure - literally they have to verify with 3d secure or they cannot proceed. If they do this you know that the card holder is the one who ordered and then they won't do anything fishy because you got their real name, address etc.

block if :is_anonymous_ip: - blocks all VPNs etc

:ip_country: != :card_country: - blocks all payments where IP is not equal to where the card was issued

and finally, block all prepaid cards, anonymous cards etc

Well, all works, you just cant pay without an account if you get prepaid cards.

ezeth

@ascicode said:

@ezeth said:

@ascicode said:

@ezeth said:
And this is why you don't accept crypto.

Just do like me.

Force 3D secure on credit card, and only accept credit card. Literally no fraud or abuse for that matter

Want to take it one step further? Not required but sure
https://stripe.com/identity

This wont stop anyone to abuse the system.

Just from personal experience. Over 1k unique clients, no fraud, not a single abuse report in over 6 months.

Here are the most effective stripe rules:

Force 3d secure - literally they have to verify with 3d secure or they cannot proceed. If they do this you know that the card holder is the one who ordered and then they won't do anything fishy because you got their real name, address etc.

block if :is_anonymous_ip: - blocks all VPNs etc

:ip_country: != :card_country: - blocks all payments where IP is not equal to where the card was issued

and finally, block all prepaid cards, anonymous cards etc

Well, all works, you just cant pay without an account if you get prepaid cards.

Review if :card_funding: = ‘prepaid’

Here's quite good documentation. https://stripe.com/docs/radar/rules. You can also hold payment until you manually review it but I think this is too much work for a lowendvps

I think stripe has the best anti fraud there is, and its most certainly the number one go to solution for lowend providers

Murv

@ezeth said: you can also have ACH bank wire. Here you can have similar rules

Fun fact: there are actually countries where the banking system is disconnected from the rest of the world!
I know it may seem unreal, but a country called Iran begs to differ!

If customer in question does not have a bank account, or a debit/credit card then I think its best to not service this customer as its too high risk

Then again, we Iranians are actually considered "high risk" by some people, so it should be fine...

hk5354

@hzhoanglee said:
I'm currently using it for my backup purpose, which is really good. So sad to hear this

same here , it is a very bad experience for the other user who is using your service in the right way.

FlorinMarian

@hk5354 said:

@hzhoanglee said:
I'm currently using it for my backup purpose, which is really good. So sad to hear this

same here , it is a very bad experience for the other user who is using your service in the right way.

I really know what you mean, but this happen when you can't find "black sheep".
Please accept my apologies, is over my knowledge & resources to help you in another way.
Best regards, Florin.

Shakib

Let's have a chat.

yanaxiao

I felt hurt and screwed up by my hateful neighbor.

hk5354

@FlorinMarian said:

@Murv said:
Guess what, I'm affected by this as well...
I thought I could get away from LET drama and relax for a while. But somehow I get dragged into them each time...

@FlorinMarian said: There are two options:

How about offering a dedicated IPv4 (for a certain price) instead of the NAT IP for those people who want to keep their servers?

Package itself is 6 eur per year and IPv4 is 12 eur/year, isn't a fesable solution for this customer range.

This is the main point , what you are selling on another post is just 1.49 per month. to pay another $1 for an IP that is close to buying a new vps from you.

Please provide a better offer for those who are affected !!

[RO] VPS Storage
LXC virtualization
1 vCPU 3.50Ghz (fair usage)
1GB DDR4 ECC
100GB SAS Storage (RAID10)
10GBps Connection
5TB Monthly Transfer (then 100MBps unlimited)
Dedicated IPv4 at only 0.50€/month (optional)
IPv6/64 Subnet Included
(Configurable, starting at 1.49 eur/mo)

Levi

Mr. Florin, do you know that you are very unqualified to run web hosting business? You do not have a clue about possible risks and data hosted with you is in great, real danger to be lost.

You enable cp hosters and skids to perform their criminal activities. Stop what you are doing, learn basics. It is so cringy to watch such incompetence. Only Borta was worse.

FlorinMarian

@LTniger said:
Mr. Florin, do you know that you are very unqualified to run web hosting business? You do not have a clue about possible risks and data hosted with you is in great, real danger to be lost.

You enable cp hosters and skids to perform their criminal activities. Stop what you are doing, learn basics. It is so cringy to watch such incompetence. Only Borta was worse.

I don't think your comment help me to manage this situation somehow but let's say "Thank you".
Best regards, Florin.

ezeth

I am not surprised this happened though. You should start by removing the following payment methods: Paysafecard, Coinbase (Cryptocurrency). Accepting these is literally asking for illegal stuff to be run on your vps

FlorinMarian

@ezeth said:
I am not surprised this happened though. You should start by removing the following payment methods: Paysafecard, Coinbase (Cryptocurrency). Accepting these is literally asking for illegal stuff to be run on your vps

Paysafecard is mainly used in Germany by our customers which are not part of LET community.
Update regarding refund options, STRIPE PAYMENTS CAN BE REFUNDED TO ORIGINAL PAYMENT SOURCE.