my server is under attack... from itself!?! - GoFuckYourself.com

xanx · 05-09-2008, 08:57 PM

For some reason I am getting a lot of requests for a set of images over and over again. The strange thing is, the IP that's making the request is my own servers IP.

Any idea what this is ?

GrouchyAdmin · 05-09-2008, 09:04 PM

It's always sad when the host's immune system turns against itself.

3M TA3 · 05-09-2008, 09:05 PM

hmm, are the images linked from a java script on your server? the log file should tell you

baddog · 05-09-2008, 09:06 PM

Quote:

Originally Posted by GrouchyAdmin

It's always sad when the host's immune system turns against itself.

Server AIDS?

This just start? Did you modify htaccess recently?

xanx · 05-09-2008, 09:11 PM

didn't touch the .htaccess recently. I'm thinking a rogue script maybe but not even sure where to begin to look =(

baddog · 05-09-2008, 09:12 PM

Quote:

Originally Posted by xanx

didn't touch the .htaccess recently. I'm thinking a rogue script maybe but not even sure where to begin to look =(

That was my first guess, but was hoping it would be simple. Trojans suck. Server not managed?

Grapesoda · 05-09-2008, 09:12 PM

Quote:

Originally Posted by GrouchyAdmin

It's always sad when the host's immune system turns against itself.

php-aids?

xanx · 05-09-2008, 09:16 PM

Quote:

Originally Posted by baddog

That was my first guess, but was hoping it would be simple. Trojans suck. Server not managed?

nah, starting to wish it was though =)

Superterrorizer · 05-09-2008, 09:19 PM

You are including URLs in your pages and not files. That's why you're bombing your server. If you are running a script that's linking images like that, it was written by a tool and you should use something else.

GrouchyAdmin · 05-09-2008, 09:25 PM

Quote:

Originally Posted by baddog

Server AIDS?

This just start? Did you modify htaccess recently?

Quote:

Originally Posted by bm bradley

php-aids?

Usually caused by include("http://file"); instead of include('file'); or readfile('file');

tony286 · 05-09-2008, 09:38 PM

Its like the terminator, the machines learned and started taking over.

xanx · 05-09-2008, 09:45 PM

Quote:

Originally Posted by GrouchyAdmin

Usually caused by include("http://file"); instead of include('file'); or readfile('file');

The strange thing is it seems to only be effected on one set of images. No other images on the site are getting called repeatedly.

GrouchyAdmin · 05-09-2008, 09:49 PM

Quote:

Originally Posted by xanx

The strange thing is it seems to only be effected on one set of images. No other images on the site are getting called repeatedly.

Well, you aren't going to want to write things like that. If you have an offsite link with a passthrough function, people could be using it to steal your content by proxy.

Wanna nasty-workable 'test?' Try moving it and do a 0 second meta refresh redirect, not a 301. If it still continues, that's obviously not it.

Grapesoda · 05-09-2008, 09:49 PM

Quote:

Originally Posted by xanx

The strange thing is it seems to only be effected on one set of images. No other images on the site are getting called repeatedly.

I've had folders corrupted and do strange stuff. I put the files in another folder, renamed it and deleted the first folder. resolved the issue. -bmb

GoLakers · 05-09-2008, 09:55 PM

Did you check your server logs
which URL or page requesting the images ?

Sami · 05-09-2008, 10:06 PM

I would turn on access logs .. all options

then go to your apache logs directory and do a

tail -f logfilename | grep imagename.jpg

05-09-2008, 08:57 PM	#1
xanx Confirmed User Join Date: Apr 2002 Location: Orlando, FL Posts: 3,711	my server is under attack... from itself!?! For some reason I am getting a lot of requests for a set of images over and over again. The strange thing is, the IP that's making the request is my own servers IP. Any idea what this is ?

05-09-2008, 09:04 PM	#2
GrouchyAdmin Now choke yourself! Industry Role: Join Date: Apr 2006 Posts: 12,085	It's always sad when the host's immune system turns against itself. __________________ AIM: GrouchyGfy

05-09-2008, 09:05 PM	#3
3M TA3 Confirmed User Join Date: Aug 2005 Location: So Cal Posts: 2,972	hmm, are the images linked from a java script on your server? the log file should tell you __________________ Dedicated and colo hosting: ICQ 291313057 "A problem cannot be solved from the same consciousness that created it. We must learn to see the world anew." - Albert Einstein

05-09-2008, 10:06 PM	#16
Sami Confirmed User Join Date: Mar 2004 Posts: 2,047	I would turn on access logs .. all options then go to your apache logs directory and do a tail -f logfilename \| grep imagename.jpg __________________ ServerProvider.com ICQ#: 311-848-143

05-09-2008, 09:11 PM	#5
xanx Confirmed User Join Date: Apr 2002 Location: Orlando, FL Posts: 3,711	didn't touch the .htaccess recently. I'm thinking a rogue script maybe but not even sure where to begin to look =(

05-09-2008, 09:19 PM	#9
Superterrorizer Confirmed User Join Date: Sep 2003 Posts: 509	You are including URLs in your pages and not files. That's why you're bombing your server. If you are running a script that's linking images like that, it was written by a tool and you should use something else.

05-09-2008, 09:38 PM	#11
tony286 lurker Industry Role: Join Date: Aug 2002 Location: atlanta Posts: 57,021	Its like the terminator, the machines learned and started taking over.

05-09-2008, 09:55 PM	#15
GoLakers Registered User Join Date: Oct 2003 Posts: 89	Did you check your server logs which URL or page requesting the images ?