OVH Community, your new community space.

Your server has been hacked and blocked !!!


saikat
02-01-2016, 13:04
Hi,
I am also facing the same problem on my service ns3019398.ip-149-202-83.eu.
Submitted support ticket before 6 hours but no reply till now.

Igor
16-01-2015, 11:25
Your explanation help me a lot.Thank you very much. I have seen the mistake and i have corrected . Thank you again my friend.

Neil
15-01-2015, 10:56
Reinstall is complete and access codes have been sent, careful this time please.

Igor
14-01-2015, 17:29
I have reinstal my server why still blocked.ns348447

heise
14-01-2015, 12:02
Hi, servers on OVH network are being attacked multiple time an hour. So it is imperative, that you take server security serious. That means either you know how to run a server and ensure that the applications you run on the server are not hacked/misused, or you pay someone to do it for you. OVH is not suited for reselling ,since they make you responsible for faults of your customers and after a reasonable amount of warnings they close your account.

The fact, that you still did not realize the harm your server was causing in the internet, it suggests, that you do not have yet the proper skills to manage a server. I suggest, that you use Kimsufi servers to learn. They are cheaper yet reasonably powerful to play and learn.

Neil
14-01-2015, 11:32
Your server has perform 6 attacks, you need to backup and reinstall it (again). If it happens again then we will terminate your server.

Igor
13-01-2015, 19:12
Your server "ns348????.ip-37-187-???.eu" has been hacked 6 times since the delivery.

Your server has been deactivated further to recurrent unusual activity. You have received the login details to retrieve your data.
Your server will be reactivated only after a full re-installation.

This is your last warning. Any new alert will lead to the definitive closing of your server and your contract with us will end.

and this email i have received also,what dos it mean?If you speak that i am the reason for the attack why this mesage?

Neil
13-01-2015, 18:27
Hi

Your server was performing the attacks, not your server being attacked. The logs are there in the ticket. You need to backup and reinstall.

Igor
13-01-2015, 18:07
Dear Customer,

Your server ns3484??.ip-37-187-???.eu is presenting too great a threat to our network,
we had no choice but to place it in the 'rescue FTP' mode. A email
containing a username and password has been sent so that so you can
retrieve your data located in its storage space.

Feel free to communicate with our technical support so that this
situation does not become critical.

You can find the log returns from our system below that
led to this alert.

- START OF INFORMATION -

Attack detail : 69Kpps/47Mbps
dateTime srcIp:srcPort dstIp:dstPort bytes protocol

05 Jan 2015 10:00:51:238 GMT my ip:7043 182.140.167.166:53 40 TCP
05 Jan 2015 10:00:51:285 GMT my ip:26340 182.140.167.166:53 40 TCP
05 Jan 2015 10:00:51:331 GMT my ip:44525 182.140.167.166:53 40 TCP
05 Jan 2015 10:00:51:238 GMT my ip:1606 182.140.167.166:53 40 TCP
05 Jan 2015 10:00:51:267 GMT my ip:6321 182.140.167.166:53 40 TCP
05 Jan 2015 10:00:51:326 GMT my ip:44473 182.140.167.166:53 40 TCP
05 Jan 2015 10:00:51:310 GMT my ip:18334 182.140.167.166:53 40 TCP
05 Jan 2015 10:00:51:201 GMT my ip:6533 182.140.167.166:53 40 TCP
05 Jan 2015 10:00:51:310 GMT my ip:6101 182.140.167.166:53 40 TCP
05 Jan 2015 10:00:51:309 GMT my ip:34369 182.140.167.166:53 50 TCP

Do anyone have experience with this kind of message?I have some attack on my ip,and my server is blocked.