Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


weird aeza network issue, need someone who can contact them
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

weird aeza network issue, need someone who can contact them

0ka0ka Member

Me and my friend have a promo aeza vps, mine works OK (not perfect but i can accept it for the price), but his vps has a weird network issue where only some tcp connections are throttled to 0.5 mbit/s upload, testing with "iperf3 -R -c 77.221.141.144" from any windows pc results in 0.5 mbit/s, but testing from any linux pc or android results in full speed, but if i disable tcp timestamps on the vps then all tcp connections are throttled, makes me think that their anti-ddos is to blame.

If you can test his server with iperf, please do and post your results of this command
iperf3 -R -c 77.221.141.144
my result: https://i.imgur.com/emYZjaR.png

i also started iperf3 on my vps for reference (tcp timestamps are also disabled)
iperf3 -R -c 77.232.142.79
result: https://i.imgur.com/3AHURFd.png

Their telegram support sucks and i can't create a ticket because of promo vps and need someone who can contact them about it.

notes: os on both vps is fresh ubuntu 24.04, bbr is enabled and tcp timestamps are disabled (sysctl -w net.ipv4.tcp_timestamps=0), uploading from his aeza vps to my aeza vps is also slow, speedtest cli upload is also slow https://i.imgur.com/0FrY2uG.png, iperf3 on windows is slow even if both vps and windows have tcp timestamps enabled, udp is not throttled.

iperf3 for windows can be downloaded from here

Comments

  • tentortentor Member, Host Rep

    @0ka said: Their telegram support sucks and i can't create a ticket because of promo vps and need someone who can contact them about it.

    Sounds like ToS violation

    Thanked by 1COLBYLICIOUS
  • JabJabJabJab Member

    Only if there was a way to contact aeza outside of theirs support.
    Only if there was a way to contact aeza on LET.

    Oh wait, @AezaHost WHO THIS?!

    Thanked by 1oloke
  • Overclock the NIC is the only solution

    Thanked by 1skorupion
  • DazzleDazzle Member

    Promo €1/m VPS?

  • 0ka0ka Member

    @tentor said:

    @0ka said: Their telegram support sucks and i can't create a ticket because of promo vps and need someone who can contact them about it.

    Sounds like ToS violation

    i discovered 2 malicious dns servers on their network which redirected some domains, reported them 7 months ago on telegram and abuse email, and they are still up.
    https://i.imgur.com/qP3owgM.png
    found it here https://www.reddit.com/r/HomeNetworking/comments/1f3sipr/this_router_is_hacked_right/

    Thanked by 1jnd
  • 0ka0ka Member

    @AezaHost anything?

  • LeviLevi Member

    @0ka said:

    @tentor said:

    @0ka said: Their telegram support sucks and i can't create a ticket because of promo vps and need someone who can contact them about it.

    Sounds like ToS violation

    i discovered 2 malicious dns servers on their network which redirected some domains, reported them 7 months ago on telegram and abuse email, and they are still up.
    https://i.imgur.com/qP3owgM.png
    found it here https://www.reddit.com/r/HomeNetworking/comments/1f3sipr/this_router_is_hacked_right/

    It is not “malicious”. Just some cretin added domains which he does not own. It means nothing, just don’t use random nameservers.

  • 0ka0ka Member

    @Levi did you read the reddit thread? this ip was found on a hacked router, it's also on abuseipdb.com and just googling it reveals multiple hacked routers with it

    Thanked by 1DeusVult
  • xvpsxvps Member
    edited March 19

    @0ka said:

    @tentor said:

    @0ka said: Their telegram support sucks and i can't create a ticket because of promo vps and need someone who can contact them about it.

    Sounds like ToS violation

    i discovered 2 malicious dns servers on their network which redirected some domains, reported them 7 months ago on telegram and abuse email, and they are still up.
    https://i.imgur.com/qP3owgM.png
    found it here https://www.reddit.com/r/HomeNetworking/comments/1f3sipr/this_router_is_hacked_right/

    You bought a VPS from a shady Russian provider, well known for selling tunneled VPSs with fake locations and a history of abuse, and RDNS (dns-fast.aeza.network and Dns-Asia.aeza.network) for both IP addresses indicates that they are Aeza's own name servers, so have fun being ignored.

    Thanked by 2itzgeo jnd
  • 0ka0ka Member
    edited March 19

    @xvps said: and RDNS (dns-fast.aeza.network and Dns-Asia.aeza.network) for both IP addresses indicates that they are Aeza's own name servers

    they are not, "dns-fast" is just a vps name which was assigned as rdns automatically and it can be changed to anything, i just changed my rdns to "dns-slow.aeza.network" on 77.232.142.79. also these dns servers are super laggy, unusable in production

  • xvpsxvps Member

    @0ka said:

    @xvps said: and RDNS (dns-fast.aeza.network and Dns-Asia.aeza.network) for both IP addresses indicates that they are Aeza's own name servers

    they are not, "dns-fast" is just a vps name which was assigned as rdns automatically and it can be changed to anything, i just changed my rdns to "dns-slow.aeza.network" on 77.232.142.79. also these dns servers are super laggy, unusable in production

    It really doesn’t matter much. Read the following to get an idea of who you’re dealing with.

    https://correctiv.org/en/fact-checking-en/2024/07/22/inside-doppelganger-how-russia-uses-eu-companies-for-its-propaganda/

    Thanked by 2jnd kenwong
  • 0ka0ka Member
    edited March 30

    they just blocked my vps with an ip of 77.232.142.79 with this message:

    Ваша услуга заблокирована.
    Георгий сегодня в 2:23

    Здравствуйте.

    Нами была получена информация о размещении контроллера вредоносного ПО на Вашем сервере:
    " IP address: 77.232.142.79
    Issue: Botnet command and controller detection
    Malware: win.sliver

    What is the problem with this IP address?

    The Spamhaus Project's research team has intelligence indicating that the above IP address is hosting an active botnet command and controller (C&C) used by bad actors to control infected devices using win.sliver malware.

    What will happen due to this problem?

    As a result of this detection, this IP address is now listed on the Spamhaus Botnet Controller List (BCL).

    Technical information
    win.sliver botnet controller located at 77.232.142.79 on port 443 (using TCP) "

    Подобная деятельность не допускается Условиями использования - https://aeza.net/terms
    Услуга была заблокирована.

    i believe this is a mistake, port 443 was used for nginx for more than a year and 2 days ago i changed it to serve an xray proxy with authentication (the same proxy works fine on another vps provider for multiple months)

  • AezaHostAezaHost Member, Patron Provider

    @0ka said:
    i believe this is a mistake, port 443 was used for nginx for more than a year and 2 days ago i changed it to serve an xray proxy with authentication (the same proxy works fine on another vps provider for multiple months)

    Hello, your server may have been compromised and malware may have been installed on it. We cannot influence this situation, as we do not know the exact scenario of server usage. This situation occurred due to an abuse from Spamhaus, just like the support message says.

  • AezaHostAezaHost Member, Patron Provider

    @tentor said:

    @0ka said: Their telegram support sucks and i can't create a ticket because of promo vps and need someone who can contact them about it.

    Sounds like ToS violation

    There is a warning about the limitations of the PROMO tariff before order.

  • jndjnd Member

    @xvps said:

    @0ka said:

    @xvps said: and RDNS (dns-fast.aeza.network and Dns-Asia.aeza.network) for both IP addresses indicates that they are Aeza's own name servers

    they are not, "dns-fast" is just a vps name which was assigned as rdns automatically and it can be changed to anything, i just changed my rdns to "dns-slow.aeza.network" on 77.232.142.79. also these dns servers are super laggy, unusable in production

    It really doesn’t matter much. Read the following to get an idea of who you’re dealing with.

    https://correctiv.org/en/fact-checking-en/2024/07/22/inside-doppelganger-how-russia-uses-eu-companies-for-its-propaganda/

    Very good read, thanks. People should stay away from them.

  • techdragontechdragon Member
    edited March 31

    @0ka said:
    they just blocked my vps with an ip of 77.232.142.79 with this message:

    Ваша услуга заблокирована.
    Георгий сегодня в 2:23

    Здравствуйте.

    Нами была получена информация о размещении контроллера вредоносного ПО на Вашем сервере:
    " IP address: 77.232.142.79
    Issue: Botnet command and controller detection
    Malware: win.sliver

    What is the problem with this IP address?

    The Spamhaus Project's research team has intelligence indicating that the above IP address is hosting an active botnet command and controller (C&C) used by bad actors to control infected devices using win.sliver malware.

    What will happen due to this problem?

    As a result of this detection, this IP address is now listed on the Spamhaus Botnet Controller List (BCL).

    Technical information
    win.sliver botnet controller located at 77.232.142.79 on port 443 (using TCP) "

    Подобная деятельность не допускается Условиями использования - https://aeza.net/terms
    Услуга была заблокирована.

    i believe this is a mistake, port 443 was used for nginx for more than a year and 2 days ago i changed it to serve an xray proxy with authentication (the same proxy works fine on another vps provider for multiple months)

    @AezaHost Why didn't you forward the original abuse report to the client?

  • @jnd said:

    @xvps said:

    @0ka said:

    @xvps said: and RDNS (dns-fast.aeza.network and Dns-Asia.aeza.network) for both IP addresses indicates that they are Aeza's own name servers

    they are not, "dns-fast" is just a vps name which was assigned as rdns automatically and it can be changed to anything, i just changed my rdns to "dns-slow.aeza.network" on 77.232.142.79. also these dns servers are super laggy, unusable in production

    It really doesn’t matter much. Read the following to get an idea of who you’re dealing with.

    https://correctiv.org/en/fact-checking-en/2024/07/22/inside-doppelganger-how-russia-uses-eu-companies-for-its-propaganda/

    Very good read, thanks. People should stay away from them.

    this is...fucking nuts. I don't at all understand the effort to infiltrate lowendtalk of all places though if this has some truth to it. like what data is there to gather from the customers here? why spend any effort on this forum? this is a fairly benign crowd.

  • 0ka0ka Member
    edited March 31

    so it's possible to answer the ticket after renting a regular vps for an hour (and they even give a balance for it), they agreed to allow access for 1 hour and then they will reinstall the OS. i believe the issue is in the self signed TLS cert i used (second command from here https://stackoverflow.com/a/10176685, the same command was probably used in a botnet software or something like that), because another VPS on another provider with the same proxy and cert is listed on spamhaus with the same win.sliver, I'll setup the same proxy on another IP but with a different tls cert to confirm this theory.
    and im going away from them after the paid period ends.

  • tentortentor Member, Host Rep

    @0ka said: another VPS on another provider with the same proxy and cert is listed on spamhaus with the same win.sliver

    I doubt the issue lies in a TLS certificate. I would have a look at an xray software instead.

  • 0ka0ka Member

    @tentor this is my config file https://pastebin.com/ZAjbf2ww for https://github.com/XTLS/Xray-core/, it's working on another vps for 2 months and i periodically checked its logs, didn't notice anything unusual, and the ip address is not on abuseipdb

  • 0ka0ka Member

    @0ka said: they agreed to allow access for 1 hour

    that actually meant ssh access to a system rescue live cd which they activate on their side, but VNC access also starts working and it's possible to reboot the system and boot it normally (i needed to verity that the database was shut down properly and make a proper backup with pg_dump)

Sign In or Register to comment.