Ciuly's Blog – Reinventing the wheel

My server suddenly went under a very heavy load, similar with a DOS (Denial Of Service) attack. Luckily I was 1 foot away form it and heard the hard-drive working like crazy so I ssh-ed in the server, checked the running processes, noticed it was a high load on mysql (only possible via web), did a netstat, found the offending IP and temporarely -j DROP-ped it out with iptables. the load stopped suddenly so my finding was right.

this is the offending ip: 85.92.222.254
anyone know the guy behind it, hit him hard in the head.
will see if he returns and if he does, the -j DROP will become permanent.
Just for the record I currently have 7 IPs with permanent -j DROP . I should probably remove them since they are pretty old and with the use of DHCP the IPs probably belong to a ton of other people now.

Related posts

• Where is the spam comming from? (0)
• When the big players go “low” and start spamming (0)
• The power of content spam, or how to foul search engines (0)
• Stupid spam-fighters [rant] (0)
• Spamming idiots (2)

Tags: fighting spam, security

This entry was posted on Thursday, October 22nd, 2009 at 8:16 pm and is filed under my server. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.