NPServe.com - NP$ Web Hosting & Reseller Hosting **NOT Affiliated with NamePros** - Page 25

Camron · 02-15-2007, 06:50 PM

Originally Posted by infinitomagazine

Hi camron
I have this problem

http://198.145.40.44/whm
????: NamePros.com http://www.namepros.com/web-hosting-offers/257837-npserve-com-np-web-hosting-reseller.html
http://198.145.40.44/cpanel
user: cvms

Internal Server Error
The server is too busy to handle your request. Please wait a few minutes and try again.

--------------------------------------------------------------------------------

cpsrvd/10.9.6 Server at 198.145.40.44

Please read other posts, we are aware of this issue.

david.amherst · 02-15-2007, 08:43 PM

cPanel is working!

Camron · 02-15-2007, 11:17 PM

Originally Posted by david.amherst

cPanel is working!

Yes, we are working on all cPanel issues and are here to gain all customers trust again. We do apologize for the downtime recently, however apache is very stable (now over 72 hours) and all ddos's are being blocked by our firewall. cPanel was also having some trouble but our techs are going to look over it to make sure such occurrence does not happen again

????: NamePros.com http://www.namepros.com/showthread.php?t=257837

Thanks,
Camron

mtorregiani · 02-16-2007, 04:38 AM

Thank you so much Camron. I don't know if there is a better host than this...

vlad230 · 02-16-2007, 06:43 AM

All is up

Hope it keeps it like this

Coop · 02-16-2007, 08:31 AM

I bought a package, awaiting username and stuff.

ccm · 02-16-2007, 10:48 AM

down again

dgridley · 02-16-2007, 10:52 AM

Sending payment for my account despite the downtime... I know it wasn't your fault and hopefully we can get the CPanel issues fixed soon as I need to get in and do maintenance on a regular basis!

Camron · 02-16-2007, 11:56 AM

Originally Posted by dav3.us

Sending payment for my account despite the downtime... I know it wasn't your fault and hopefully we can get the CPanel issues fixed soon as I need to get in and do maintenance on a regular basis!

I understand, my techs keep on getting it fixed yet they are ddosing cpanel and the way cpanel is setup, it's hard to get a monitor running to block the users. I am working on a custom script to block users over 50 connections on cpanel.

dgridley · 02-16-2007, 12:38 PM

Yes, I need to setup some new domain accounts in the WHM and can't access it.

Originally Posted by Camron

I understand, my techs keep on getting it fixed yet they are ddosing cpanel and the way cpanel is setup, it's hard to get a monitor running to block the users. I am working on a custom script to block users over 50 connections on cpanel.

snike · 02-16-2007, 12:52 PM

Hm. so it looks like this has been going on for a while. I hope it gets fixed soon, even though I am not hosted here. I know what it feels like. Camron always had good hosting. Best of luck peoples.

Camron · 02-16-2007, 09:39 PM

Originally Posted by dav3.us

Yes, I need to setup some new domain accounts in the WHM and can't access it.

Everyone now can access cPanel/WHM using the secure ports, https://npserve.com:2083 and https://npserve.com:2087 as there is a severe ddos against the regular ports. cPanel is working fine on the secure ports.

weblord · 02-16-2007, 11:33 PM

thanks Camron

Slewey · 02-17-2007, 11:36 AM

Originally Posted by Camron

Everyone now can access cPanel/WHM using the secure ports, https://npserve.com:2083 and https://npserve.com:2087 as there is a severe ddos against the regular ports. cPanel is working fine on the secure ports.

Haven't be able to access them for the whole day now?
????: NamePros.com http://www.namepros.com/showthread.php?t=257837
My normal domain(s) seems to be down aswell!

Last days before where actually pretty stable! Hope/Guess it will be back up soon?

Alex. · 02-17-2007, 12:01 PM

works for me fine, though its been so long ive forgot my pass

need to reset it now..

Slewey · 02-17-2007, 01:57 PM

Seems it's working for me again too!

Cal_123 · 02-17-2007, 02:12 PM

www.npserve.com has been hacked, has anyone seen this? Will this effect the websites?

Matthew. · 02-17-2007, 02:18 PM

Ladies and Gentlemen, i present: Script kiddies 101.

Some people need to grow up huh. Cal_123 is has affected everyones, for example Dave's:

http://dav3.us

Matt

Slewey · 02-17-2007, 02:24 PM

hmm..

Seems like I'm still having some problems, PM on the Way

dgridley · 02-17-2007, 02:30 PM

I see that! I'm assuming that's accomplished with a redirect of some kind?

Can Camron do a global fix or does this have to be fixed on an individual basis in some way?
????: NamePros.com http://www.namepros.com/showthread.php?t=257837

Originally Posted by Matthew.

Ladies and Gentlemen, i present: Script kiddies 101.

Some people need to grow up huh. Cal_123 is has affected everyones, for example Dave's:

http://dav3.us

Matt

weblord · 02-17-2007, 02:46 PM

camron, help all my sites are showing these, screenshots, i manage to pull the source
????: NamePros.com http://www.namepros.com/showthread.php?t=257837
code on the text and decrypting it..
the original exploited encyrpted page:
source_code.txt

the decrypted:
decrypted.txt

HTH all my sites are on this server btw.
all pages redirects to

HTML Code:

http://www.zone-h.com/component/option,com_attacks/Itemid,43/filter_defacer,JaMaYcKa/

if i delete all pages, it will not appear (even .htaccess deleted) and then I will upload it again, im seeing the pages, it's up to Camron now what to do.

i can't login to whm/cpanel so i can't see the source: ip address. that's all i can do to help. pls. im relying on these web sites pls return it back soonest possible time.

Alex. · 02-17-2007, 03:10 PM

O.o
what i cant understand is:
why he left his email address'

@weblord, how did you decrypt it and make the link to that site?

Matthew. · 02-17-2007, 03:14 PM

Originally Posted by manofgames

O.o
what i cant understand is:
????: NamePros.com http://www.namepros.com/showthread.php?t=257837
why he left his email address'

@weblord, how did you decrypt it and make the link to that site?

manofgames, whoever did this is obviously part of a group of so called "hackers" (script kiddies) who enjoy boasting about 'what they can do'. He left his email address etc as many will add it and 'beg' for their site back, which of course they will enjoy.

It happens a lot.

You can decrypt the source using unescape.

dgridley · 02-17-2007, 03:15 PM

It's a CPanel FTP exploit from what I understand.. NPServe has been having problems with CPanel and DDOS attacks as it was.. looks like they finally got thru. If you try to login to your CPanel, you'll see the same pages.

Wesley · 02-17-2007, 03:24 PM

Great

It's really weird... Anyways, I hope there's either a backup or nothing was deleted... I don't have a backup of my database X.X Wish I did. One of my .txt pages that was for a quick counter script wasn't affected, so maybe most stuff was left alone.

02-15-2007, 08:43 PM	#602 (permalink)
david.amherst Senior Member Join Date: Nov 2005 Location: Bay Area Posts: 1,335	cPanel is working! __________________ Donate to the NP Emergency Fund Today!

02-16-2007, 06:43 AM	#605 (permalink)
vlad230 Senior Member Join Date: Aug 2006 Location: Romania Posts: 1,745	All is up Hope it keeps it like this __________________ Win $$$ cash $$$ on auto4tuning.com! Car Tuning Directory Submission JuegosJuegos

02-16-2007, 08:31 AM	#606 (permalink)
Coop NamePros Member Join Date: Jun 2005 Location: Ohio Posts: 195	I bought a package, awaiting username and stuff. __________________ Start making an amazing online income now with affiliate marketing! My Blog

02-16-2007, 10:48 AM	#607 (permalink)
ccm KICKASS Join Date: Nov 2004 Posts: 1,201	down again __________________ fishtail.net \| Spouty.com \| LumbarSpine.net \| kingfish.org \| tightlines.org \| z-z.org newcellphone.org \|MacNugget.com\| EZPG.com \| TheeBomb.com SportFisher.net \|

02-16-2007, 10:52 AM	#608 (permalink)
dgridley NamePros Legend Join Date: Jul 2004 Location: SW Missouri Posts: 18,396 Follow @davew3b	Sending payment for my account despite the downtime... I know it wasn't your fault and hopefully we can get the CPanel issues fixed soon as I need to get in and do maintenance on a regular basis! __________________ davew3b tumblr blog \| davew3b posterous blog

	FrostLayer - Affordable Quality Dedicated Servers	Forum Sponsorship
	If you're reading this ad, you're probably about to save some money on a dedicated server. Go ahead. Visit FrostLayer.com if you don't believe me.

02-16-2007, 04:38 AM	#604 (permalink)
mtorregiani Senior Member Join Date: Jul 2006 Location: Montevideo, Uruguay Posts: 1,601	Thank you so much Camron. I don't know if there is a better host than this...

02-16-2007, 12:52 PM	#611 (permalink)
snike NamePros Regular Join Date: Mar 2006 Location: USA Posts: 497	Hm. so it looks like this has been going on for a while. I hope it gets fixed soon, even though I am not hosted here. I know what it feels like. Camron always had good hosting. Best of luck peoples.

02-16-2007, 11:33 PM	#613 (permalink)
weblord NamePros Legend Join Date: Dec 2005 Location: Philippines - www.Nabaza.com Posts: 19,784	thanks Camron __________________ Nabaza.com - Amaia

02-17-2007, 12:01 PM	#615 (permalink)
Alex. Account Suspended Join Date: Nov 2006 Location: Uk Posts: 601	works for me fine, though its been so long ive forgot my pass need to reset it now..

02-17-2007, 01:57 PM	#616 (permalink)
Slewey NamePros Regular Join Date: Apr 2004 Location: NL Posts: 808	Seems it's working for me again too!

02-17-2007, 02:12 PM	#617 (permalink)
Cal_123 NamePros Member Join Date: Dec 2006 Posts: 65	www.npserve.com has been hacked, has anyone seen this? Will this effect the websites?

02-17-2007, 02:18 PM	#618 (permalink)
Matthew. Senior Member Join Date: Dec 2006 Location: England Posts: 1,565	Ladies and Gentlemen, i present: Script kiddies 101. Some people need to grow up huh. Cal_123 is has affected everyones, for example Dave's: http://dav3.us Matt __________________ University Grade Calculator juegosjuegos Your Hotel in Austria Matratzen

02-17-2007, 02:24 PM	#619 (permalink)
Slewey NamePros Regular Join Date: Apr 2004 Location: NL Posts: 808	hmm.. Seems like I'm still having some problems, PM on the Way

02-17-2007, 03:10 PM	#622 (permalink)
Alex. Account Suspended Join Date: Nov 2006 Location: Uk Posts: 601	O.o what i cant understand is: why he left his email address' @weblord, how did you decrypt it and make the link to that site?

02-17-2007, 03:15 PM	#624 (permalink)
dgridley NamePros Legend Join Date: Jul 2004 Location: SW Missouri Posts: 18,396 Follow @davew3b	It's a CPanel FTP exploit from what I understand.. NPServe has been having problems with CPanel and DDOS attacks as it was.. looks like they finally got thru. If you try to login to your CPanel, you'll see the same pages. __________________ davew3b tumblr blog \| davew3b posterous blog

02-17-2007, 03:24 PM	#625 (permalink)
Wesley Account Suspended Join Date: Mar 2004 Location: MD Posts: 524	Great It's really weird... Anyways, I hope there's either a backup or nothing was deleted... I don't have a backup of my database X.X Wish I did. One of my .txt pages that was for a quick counter script wasn't affected, so maybe most stuff was left alone.

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)