Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


has anyone gone through this
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

has anyone gone through this


This company has gotten worse, I don't recommend it.
out in the delay for the resolution of the services

«134

Comments

  • more contexts?

  • this company?

  • dosaidosai Member

    No

  • Never go with anything like that if you can't see full ticket content!!1111oneoneoen

  • emghemgh Member

    I have faced it but I've never been able to go through it, sorry.

  • Lesson to learn here...never backup on the same machine!

  • ArkasArkas Moderator

    That panel looks familiar...

    Thanked by 1mustafamw3
  • VoidVoid Member

    Have you tried turning it off and on again?

    Thanked by 1desperand
  • typicalGtaTGtypicalGtaTG Member, Host Rep

    RackNerd!!

  • HxxxHxxx Member

    Sounds like you got something not ToS friendly in your service.

  • @jmaxwell said:
    Have you tried turning it off and on again?

    you didn't understand I was the victim of abuse and they simply suspended the server installed with a node.js application and they want to format the server and that I lose all my work configuring an application inside the server more than 10 hours configuration
    their scripts detected that my server was victim brute forcing

  • Some companies have this type of policy. I recall back in the day EV1 servers had a policy of any server that got hacked would be reformatted.

  • InceptionHostingInceptionHosting Member, Patron Provider

    @lexandri said:

    @jmaxwell said:
    Have you tried turning it off and on again?

    you didn't understand I was the victim of abuse and they simply suspended the server installed with a node.js application and they want to format the server and that I lose all my work configuring an application inside the server more than 10 hours configuration
    their scripts detected that my server was victim brute forcing

    I would like to suggest the following.

    1. You ask them to compromise and boot your server to rescue mode so you can recover your files without the OS booting.
    2. Dont allow login by password as root in future
    3. Use passwords that are not likely to be compromised as part of a basic brute force attack.

    This is not the host's fault either, it is your responsibility to take backups of your data and to properly secure your server, I presume you don't want to pay for the time they have had to spend on this... you may find their attitude changes if you do offer to pay.

  • I mean, if you are hosting something serious, why the hell would you host on racknerd....

    Thanked by 2desperand dystopia
  • InceptionHostingInceptionHosting Member, Patron Provider

    @Hayashima said:
    I mean, if you are hosting something serious, why the hell would you host on racknerd....

    Well people don't know what they don't know until they do :)

    Thanked by 1desperand
  • VoidVoid Member

    @lexandri said:

    @jmaxwell said:
    Have you tried turning it off and on again?

    you didn't understand I was the victim of abuse and they simply suspended the server installed with a node.js application and they want to format the server and that I lose all my work configuring an application inside the server more than 10 hours configuration
    their scripts detected that my server was victim brute forcing

    apologies I understand it seems that the universe has conspired against you in the most unfortunate way possible perhaps the server felt threatened by your impeccable coding skills and decided to take matters into its own hands as for the IT department well they probably just needed a good laugh and thought it would be hilarious to watch you suffer as they wiped away all your hard work but fear not for you are a resilient and talented individual who will surely overcome this setback in no time

  • @InceptionHosting said:

    @lexandri said:

    @jmaxwell said:
    Have you tried turning it off and on again?

    you didn't understand I was the victim of abuse and they simply suspended the server installed with a node.js application and they want to format the server and that I lose all my work configuring an application inside the server more than 10 hours configuration
    their scripts detected that my server was victim brute forcing

    I would like to suggest the following.

    1. You ask them to compromise and boot your server to rescue mode so you can recover your files without the OS booting.
    2. Dont allow login by password as root in future
    3. Use passwords that are not likely to be compromised as part of a basic brute force attack.

    This is not the host's fault either, it is your responsibility to take backups of your data and to properly secure your server, I presume you don't want to pay for the time they have had to spend on this... you may find their attitude changes if you do offer to pay.

    my friend i am the victim scans and brute force attacks exist from the moment you put an ip online

  • @hennaboy said:
    Some companies have this type of policy. I recall back in the day EV1 servers had a policy of any server that got hacked would be reformatted.

    only their fail2ban script detected it was trying to hack into my server by brute force they simply suspended the service and I was a victim

  • @lexandri said:

    only their fail2ban script detected it was trying to hack into my server by brute force they simply suspended the service and I was a victim

    Can you share a screenshot of your ticket (or "work order")?

  • @lexandri said:

    only their fail2ban script detected it was trying to hack into my server by brute force they simply suspended the service and I was a victim

    I highly doubt that's the whole truth.
    I have two servers with the same provider and they are taking a hell of a beating on port 22, worst I've ever seen, and still they've been running flawlessly for years without a single complaint from the provider.

    Are you absolutely sure that it was not your server that got stuck in a fail2ban script when it was attacking someone else?

  • InceptionHostingInceptionHosting Member, Patron Provider

    @lexandri said: my friend i am the victim scans and brute force attacks exist from the moment you put an ip online

    Yep, that is the background noise of the internet, your host did not suspend your server just because someone was trying, if that was the case, they would not put it back online even AFTER a reinstall. the issue really is that your server was actually compromised and it was probably being used to brute force others.

    Please apply common sense to the situation.

  • @lexandri said:

    This company has gotten worse, I don't recommend it.
    out in the delay for the resolution of the services

    @lexandri said:

    @jmaxwell said:
    Have you tried turning it off and on again?

    you didn't understand I was the victim of abuse and they simply suspended the server installed with a node.js application and they want to format the server and that I lose all my work configuring an application inside the server more than 10 hours configuration
    their scripts detected that my server was victim brute forcing

    10 Hours of Configuration in 2023? So you wont redeploy app for rest of your life? Come on man.

  • dustincdustinc Member, Patron Provider, Top Host

    There have been excessive abuse complaints regarding this unmanaged VPS service, we are quite familiar with the OP's account, and we are open to resolving it with him, but based on the quantity of abuse complaints (that were unaddressed/unanswered for ~one week), we need to figure how to permanently resolve this. We aren't saying that this user is intentionally performing this abuse, it could be happening for a number of reasons, i.e. a compromised VM or application hosted within that VM.

    As others pointed out, a lot of information is missing here and only selected parts of the ticket were shared by the OP.

    Looking at the full ticket I see that we unsuspended the service already, so that the OP can grab their data as well as investigate the logs within their OS to see what occurred. From there the OP can either reinstall the VPS or patch up the root cause if it is possible to fix without a reinstall.

    We always try to work with our customers in the fairest, and most humanized manner possible, and I'm sure anyone here that has experience with our services can speak for that. We'll do the same for this customer and continue to work with him via ticket if any further assistance is needed from our side.

    Thanked by 2emg dystopia
  • @InceptionHosting said:

    @lexandri said: my friend i am the victim scans and brute force attacks exist from the moment you put an ip online

    Yep, that is the background noise of the internet, your host did not suspend your server just because someone was trying, if that was the case, they would not put it back online even AFTER a reinstall. the issue really is that your server was actually compromised and it was probably being used to brute force others.

    Please apply common sense to the situation.

    I set up these logins where my server appears as an attacker and as a victim

  • lexandrilexandri Member
    edited April 2023


    I set up these logins where my server appears as an attacker and as a victim

  • @rcy026 said:

    @lexandri said:

    only their fail2ban script detected it was trying to hack into my server by brute force they simply suspended the service and I was a victim

    I highly doubt that's the whole truth.
    I have two servers with the same provider and they are taking a hell of a beating on port 22, worst I've ever seen, and still they've been running flawlessly for years without a single complaint from the provider.

    Are you absolutely sure that it was not your server that got stuck in a fail2ban script when it was attacking someone else?

    if there is something compromised and their installation image there is only one node.js application inside the server

  • @dustinc said:
    There have been excessive abuse complaints regarding this unmanaged VPS service, we are quite familiar with the OP's account, and we are open to resolving it with him, but based on the quantity of abuse complaints (that were unaddressed/unanswered for ~one week), we need to figure how to permanently resolve this. We aren't saying that this user is intentionally performing this abuse, it could be happening for a number of reasons, i.e. a compromised VM or application hosted within that VM.

    As others pointed out, a lot of information is missing here and only selected parts of the ticket were shared by the OP.

    Looking at the full ticket I see that we unsuspended the service already, so that the OP can grab their data as well as investigate the logs within their OS to see what occurred. From there the OP can either reinstall the VPS or patch up the root cause if it is possible to fix without a reinstall.

    We always try to work with our customers in the fairest, and most humanized manner possible, and I'm sure anyone here that has experience with our services can speak for that. We'll do the same for this customer and continue to work with him via ticket if any further assistance is needed from our side.

    what is that? I did not answer?
    I got in touch 3x about them
    you are not serious
    so much so that the ceo/owner company is being judged by the laws

  • @lexandri said:

    I set up these logins where my server appears as an attacker and as a victim

    It looks like

    • Your VPS (IP:198.46.131.***[RackNerd]) has been hacked
    • Someone is doing a brute force attack from your VPS to machines on other networks

    I may be misunderstanding, so please let me know if so.

    Thanked by 1dystopia
  • @tototo said: It looks like

    Your VPS (IP:198.46.131.***[RackNerd]) has been hacked

    Someone is doing a brute force attack from your VPS to machines on other networks
    I may be misunderstanding, so please let me know if so.

    you read that the target ip is the same as the destination ip
    I would use brute force against myself...

This discussion has been closed.