But the question is why also Kaspersky forums seem to be inaccessible for me? Have been most part of today, pages hardly load at all.
I don't want to spread FUD, just curious if there's larger DDoS or such in progress? I do realize the reason can be completely innocent and unrelated to IBR situation.
This server is under a DOS attack. Specifically, they are targeting the IP 207.58.151.145 on port 80 (webserver). Over 10000 SYN_RECV connections existed in a netstat when I originally logged in. I was able to mitigate much of this by installing the CSF firewall and setting the SYN flood rate to 40/sec. That said, the load is still high and I am not comfortable lowering the SYN rate any lower, as it might block legitimate traffic. This is a distributed attack, occurring from hundreds of different (potentially spoofed) IP addresses. Typically these attacks do not last for a long time, but it might be a few days before it dies off. (inboxrevenge.com)
Per an IBR blog posting IBR is still under a DDos attack at times but if you have been unable to connect it may be due to your IP address being blocked and to respond to an earlier status email that you should have received so that the block can be removed. I never received an IBR email.
If someone has Ikillspammers or AlphaC email address could they PM me. If you need I can PM you my IBR or SA sign on and my email address.
I am a member but I do not have any emails so this blog posting does not help me.
"If you're a regular member and not able to get on at all, please email us to make sure your IP isn't blocked. The easiest way is to reply to one of the emails you have received notifying you of forum post replies. "
When trying to log on at http://ksforum.inboxrevenge.com/ I get:
"Server: ksforum.inboxrevenge.com
Referred from: (none)
Requested file: /
Error status code: 403
I am sorry, but we can not find the file you requested. Please see if you made a keying error, and try again.
>Return to the forum"
It appears my Comcast IP range is blocked as I tried on 3 PCs but then again I am only guessing since I do not know what the status of IBR is.
Clicked on that link and got the same message you got, except it was "Referred from: http://www.mywot.com/en/comment/reply/4715/22390" (which is this very thread of course). My ISP is Frontier, and I doubt they have blocked that IP.
If your friend has enough computers under his control to conduct a DDoS -- a distributed denial of service attack, i.e., an attack taken by many computers on a single target -- he's involved in a lot more illegal activity than just a prank to annoy the school administration. The computers used to do these are infected with Trojan Horse programs which allow the attacker to control them without the owners' knowledge or permission. He could go to jail, or his parents could even end up owing hundreds of thousands of dollars to compensate all the people whose computers he has damaged.
I stumbled across this while doing searches for who would be attacking our IP. :)
The attack is still ongoing (entering day eight,) and consists of a 12 - 13 minute ping request per client. (So far: at least several hundreds of clients are involved in the attack.)
As such we're mitigating and attempting to log and then block as many IP's as are participating in this criminal act.
Law enforcement and other agencies have been notified, and this attack may be related to at least two others that we know to be currently underway.
If we assume (as I do) that this attack is being executed via botnet, this would likely have cost the perpetrators several thousand dollars so far. I can only speak for myself but this was definitely not money well spent, as it is doing nothing to stop our research or communications.
It would be nice it you'd post the IP's once you get a list compiled...
WOT not only refers to domain names, but IP's as well.
example: 61.191.63.150
-------
WOT Services Ltd. - gives us safety through Web of Trust.
WOT Community - gives us security through unity.
Thank you all
- G7W
AttacK
ons 28 okt 2009 17.10.01 av amishrabbitAch, laddie, attack has a K
But the question is why also
ons 28 okt 2009 18.47.56 av lordpakeBut the question is why also Kaspersky forums seem to be inaccessible for me? Have been most part of today, pages hardly load at all.
I don't want to spread FUD, just curious if there's larger DDoS or such in progress? I do realize the reason can be completely innocent and unrelated to IBR situation.
"Men make good pets."
use this to check site up or
ons 28 okt 2009 21.45.41 av demonluouse this to check site up or down...
http://downforeveryoneorjustme.com/
forum.kaspersky.com
ons 28 okt 2009 23.14.08 av g7w-------
WOT Services Ltd. - gives us safety through Web of Trust.
WOT Community - gives us security through unity.
Thank you all
- G7W
I have not received any of
ons 28 okt 2009 19.27.02 av xxzI have not received any of my 100 or more YAHOO Groups spam emails today. Are all these PCs now part of the DDoS attack?
down
ons 28 okt 2009 23.11.20 av g7w-------
WOT Services Ltd. - gives us safety through Web of Trust.
WOT Community - gives us security through unity.
Thank you all
- G7W
I'm not sure...
ons 28 okt 2009 23.17.43 av SpiderLoverI'm not sure if this has anything to do with a DOS attack, but it seems that http://blog.siteadvisor.com is out as well...
Knujon News Post
fre 30 okt 2009 16.23.18 av xxzInBoxRevenge under DDos attack
October 30, 2009
This server is under a DOS attack. Specifically, they are targeting the IP 207.58.151.145 on port 80 (webserver). Over 10000 SYN_RECV connections existed in a netstat when I originally logged in. I was able to mitigate much of this by installing the CSF firewall and setting the SYN flood rate to 40/sec. That said, the load is still high and I am not comfortable lowering the SYN rate any lower, as it might block legitimate traffic. This is a distributed attack, occurring from hundreds of different (potentially spoofed) IP addresses. Typically these attacks do not last for a long time, but it might be a few days before it dies off. (inboxrevenge.com)
I need an email addess for IBR
mån 2 nov 2009 09.52.19 av xxzPer an IBR blog posting IBR is still under a DDos attack at times but if you have been unable to connect it may be due to your IP address being blocked and to respond to an earlier status email that you should have received so that the block can be removed. I never received an IBR email.
If someone has Ikillspammers or AlphaC email address could they PM me. If you need I can PM you my IBR or SA sign on and my email address.
Thank You
Jim_P
IBR Status?
tis 3 nov 2009 10.56.55 av xxzHas anybody got any status on IBR?
I am a member but I do not have any emails so this blog posting does not help me.
"If you're a regular member and not able to get on at all, please email us to make sure your IP isn't blocked. The easiest way is to reply to one of the emails you have received notifying you of forum post replies. "
When trying to log on at http://ksforum.inboxrevenge.com/ I get:
"Server: ksforum.inboxrevenge.com
Referred from: (none)
Requested file: /
Error status code: 403
I am sorry, but we can not find the file you requested. Please see if you made a keying error, and try again.
>Return to the forum"
It appears my Comcast IP range is blocked as I tried on 3 PCs but then again I am only guessing since I do not know what the status of IBR is.
Working ok now!
tis 3 nov 2009 11.11.13 av shazzaHave sent a couple of pms for you referencing this thread - hope it helps.
Same
tis 3 nov 2009 14.18.40 av BobJamClicked on that link and got the same message you got, except it was "Referred from: http://www.mywot.com/en/comment/reply/4715/22390" (which is this very thread of course). My ISP is Frontier, and I doubt they have blocked that IP.
InBoxRevenge 403 error
fre 30 okt 2009 23.33.40 av g7wInBoxRevenge
OOPS!
Error: 403 Forbidden
Sorry: The file you requested is not allowed to be browsed by you.
InboxRevenge DDoS
mån 2 nov 2009 12.52.22 av AlphaCentauriAnyone who wants to reach SiL, use the same email address your forum notifications come from.
Jim_P, I'll get someone who has forum addresses to contact you.
Continued DDoS.
ons 4 nov 2009 18.33.19 av shazzaInboxRevenge is offline again due to continued DDoS
A friend
mån 2 nov 2009 13.26.39 av tomgagagaA friend of mine delibrately did a denial of service attack on his school website, http://npcc.org.sg
Is there any way we can try to stop him, or get the site up again from here?
"Devoted supporter of LiVeRpUdLiAn932"
Re: A friend
mån 2 nov 2009 14.00.12 av SamiYou can a) call your ISP and ask them to start working on blocking the attack and b) call the police if you know the person who is responsible.
or tell ur school to expel
mån 2 nov 2009 16.41.20 av demonluoor tell ur school to expel him...
DDoS on school
tis 3 nov 2009 01.48.47 av AlphaCentauriIf your friend has enough computers under his control to conduct a DDoS -- a distributed denial of service attack, i.e., an attack taken by many computers on a single target -- he's involved in a lot more illegal activity than just a prank to annoy the school administration. The computers used to do these are infected with Trojan Horse programs which allow the attacker to control them without the owners' knowledge or permission. He could go to jail, or his parents could even end up owing hundreds of thousands of dollars to compensate all the people whose computers he has damaged.
Update on the IBR attack
tor 5 nov 2009 14.27.27 av spamislameHello.
I stumbled across this while doing searches for who would be attacking our IP. :)
The attack is still ongoing (entering day eight,) and consists of a 12 - 13 minute ping request per client. (So far: at least several hundreds of clients are involved in the attack.)
As such we're mitigating and attempting to log and then block as many IP's as are participating in this criminal act.
Law enforcement and other agencies have been notified, and this attack may be related to at least two others that we know to be currently underway.
If we assume (as I do) that this attack is being executed via botnet, this would likely have cost the perpetrators several thousand dollars so far. I can only speak for myself but this was definitely not money well spent, as it is doing nothing to stop our research or communications.
More as I get it. Thanks for the postings.
SiL
--
SiL / IKS / concerned citizen
http://ikillspammers.blogspot.com
http://spamitmustfall.blogspot.com
Thx for the update, and nice
tor 5 nov 2009 17.10.07 av lordpakeThx for the update, and nice seeing you here :)
"Men make good pets."
Welcome to WOT Forum
fre 6 nov 2009 03.13.52 av g7wIt would be nice it you'd post the IP's once you get a list compiled...
WOT not only refers to domain names, but IP's as well.
example: 61.191.63.150
-------
WOT Services Ltd. - gives us safety through Web of Trust.
WOT Community - gives us security through unity.
Thank you all
- G7W
What would the point for us
fre 6 nov 2009 06.21.08 av lordpakeWhat would the point for us to know those IPs?
Botnets likely consist mainly of home-user PCs with dynamic IPs, what would listing dynamic IPs here help?
"Men make good pets."
IBR DDoS resumed
tis 17 nov 2009 00.09.10 av AlphaCentauriFYI, the DDoS against Inboxrevenge.com has resumed again today.
Problems reaching Phishtank, too
tis 17 nov 2009 00.25.54 av amishrabbitwww.phishtank.com was inaccessible for several hours today, but seems to be back up now.