Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


DelimeterVPS shut down my server for complaints of outbound port scanning. but no proof. - Page 2
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

DelimeterVPS shut down my server for complaints of outbound port scanning. but no proof.

24

Comments

  • @8420PR - His server is actually online, just the IP is blocked. These servers have a dedicated KVM (ILO) so he can use the console to get access to the server and remove the software.

  • I guess some people just get too much time. Like they have nothing to do with their hosting business. Suggest client of that provider to leave, as you can image of what kind of treatment you will get when your service get an issue.
    This post is somehow to reminder host provider to improve host quality. And a review for host users. Not for some host provider to attack user or pull their negative idea.

  • @MarkTurner

    Like @Jar said "Life is too short to deal with people like this."

  • @O8ama said:
    I guess some people just get too much time. Like they have nothing to do with their hosting business. Suggest client of that provider to leave, as you can image of what kind of treatment you will get when your service get an issue.
    This post is somehow to reminder host provider to improve host quality. And a review for host users. Not for some host provider to attack user or pull their negative idea.

    @MarkTurner doesn't work for Delimiter, he works for Yomura.
    You have the characteristics of mtwiscool...

    Thanked by 2jar comXyz
  • SplitIceSplitIce Member, Host Rep

    Not taking sides, nor do I know enough to make a judgement in this case (this should be settled between the client and DelimiterVPS).

    I just wanted to say that if its an automated email from Hetzner, don't put too much stock in it. We have had incidents servers who have made humongous numbers of outgoing connections to our servers (i.e attackers), then received a email from Hetzner claiming we where port scanning (lol).

    I doubt they are alone in this, anyone who does port scan detection likely employs similar methods that may not take into consideration connection state.

    Thanked by 2O8ama KwiceroLTD
  • @Splitice - it was actually a bruteforce attack against a wordpress site, the victim sent copies of his server log and these were corroborated against flow data between the customer's IP and the victims two IPs.

  • @MarkTurner said:
    The same guy is posting here http://www.webhostingtalk.com/showthread.php?p=9343895

    According to whats being said there, his server has been trying to bruteforce someone's wordpress site and had been going on for some time before the victim filed a complaint.

    I am getting this third hand, but in summary the customer's service was suspended and told to remove the software from his server. He then spammed every ticket department which caused those tickets to end up in /dev/null, he then spammed WHT and now I see here too. Steve asked Delimiter support to investigate at which point they found all the ticket spam. Which was then merged and responded to with a full copy of the complaint.

    If the OP spent more time dealing with the issue than trying to disparage Delimiter on the forums, then his server would already be back online.

    I not try to do anything here, but tell people what happen. Nor do I try to disparage. Only truth.
    Yes, I also post a thread at WHT. Why? Your support said ILO is crash before. And KVM/ILO port is changed, not the same one when I brought, So I can do nothing at that time instead of face some angry clients.

    And yes, I submit 4 tickets, but as already explain in WHT, they are not opened at same time. There's 8 hours for 4 tickets, several hours between each ticket. Why? Because I get no reply!

    I want to dealing with the issue, but at present, your ILO is very slow, I can even not login as root. And your support insist only server can not be put on!

    What's more, the so called "prove" is just a letter from other provider. The attack IP address can be forged. If I can solve the issue and log in to server or ILO, why I will waste time on posting?

    You have time to reply long comments here, why not take more time to improve your service? Help your clients, not conflict.

  • @TriDoxiuM said:
    You have the characteristics of mtwiscool...

    The time I post that is before I see MarkTurner's posts. Actually it's not for him. But after see his following posts, I say whatever!

  • jarjar Patron Provider, Top Host, Veteran
    edited January 2015

    @O8ama said:
    And yes, I submit 4 tickets, but as already explain in WHT, they are not opened at same time. There's 8 hours for 4 tickets, several hours between each ticket. Why? Because I get no reply!

    Anyone got a facepalm for this?

    http://dictionary.reference.com/browse/several

    There's 8 hours for 4 tickets, several hours between each ticket.

    ...

    being more than two but fewer than many in number or kind

    Thanked by 3netomx tr1cky ATHK
  • O8ama said: What's more, the so called "prove" is just a letter from other provider. The attack IP address can be forged. If I can solve the issue and log in to server or ILO, why I will waste time on posting?

    The proof is not a 'letter from other provider' but the access log from the victim's web server, it was also confirmed by validating our flow data.

    I don't understand why you are making such a drama out of this, you are in control of this situation and you could have already removed this software because as you have stated 'Not likely to be hacked. As I use very strong security method of the server' so only you could have installed that software.

    So log in to the server through the ILO, remove it and then notify Delimiter.

    The longer you drag it out, the longer the server will remain suspended, nothing is going to change that situation on our side.

  • TheLinuxBugTheLinuxBug Member
    edited January 2015

    @O8ama Simply put, your idea of how this should be handled is wrong. You went about this in completely the wrong way. It seems you are an inexperienced system admin also as you are not willing to accept the fact that on occasion, sites get hacked and things happen. If you were to patiently work with support, instead of trying to blame them, to resolve the issue, I am sure they would be much happier to assist you with getting things online.

    I will tell you this though, after working support for a company in this industry for about 3 years, if you opened a ticket in the same way you started this thread, I would bin your request as well. Your tone carries only disrespect and not the tone of someone who needs help to find out what the issue is, so it can be fixed.

    I would suggest you review the following article on how to properly open a support ticket.

    You will find that a lot of the issues you are seeing are caused by how you are handling the issue, more so than their lack of support or response.

    I am not saying they couldn't have been more forthcoming about the cause of the issue, but your impatient method of handling the issue is all wrong and most companies would not put up with it. Plus, following up your actions with running to a forum to cry like a teenager, helps nothing. In the future, be more patient, calm and work with support to resolve the issue instead.

    Cheers!

  • OP is a moron, let's not waste our time

  • @MarkTurner said:
    The longer you drag it out, the longer the server will remain suspended, nothing is going to change that situation on our side.

    As I mentioned before, the connect to KVM is too slow to even log in as root. And your support refuse to put server on for 24 hours. Please tell me how can I solve the problem as I can not access to server?
    You think I have too much time to waste? I need to face clients too.

  • @O8ama said:
    I guess some people just get too much time. Like they have nothing to do with their hosting business. Suggest client of that provider to leave, as you can image of what kind of treatment you will get when your service get an issue.
    This post is somehow to reminder host provider to improve host quality. And a review for host users. Not for some host provider to attack user or pull their negative idea.

    The only person with too much time is someone who spent hours bashing DelimiterVPS on several forums and spamming their support department, rather than fixing their own unmanaged server (through ILO).

    This thread wouldn't put anyone off DelimiterVPS. In fact I actually feel sorry for them if they have to deal with clients like you.

  • To be honest I feel sorry for all of the hosts who have to put up with this stuff.

    Wait a second you have clients??

  • DBADBA Member

    O8ama said: As I mentioned before, the connect to KVM is too slow to even log in as root. And your support refuse to put server on for 24 hours. Please tell me how can I solve the problem as I can not access to server? You think I have too much time to waste? I need to face clients too.

    Out of band management needs to be tested on a regular basis just like test restores of backups and for the same reason: so they are functional when needed.

    You should have tested/used the iLO on a regular basis so any problems could be discovered and fixed before winding up in a situation like the current one.

  • I think this thread is much more gaining potential clients to Delimiter than scares them. Delimiter -do not forget that they are a budget dedi provider- is handling the situation as they should. The only proof that OP is not the one that ACTUALLY tried to bruteforce another website, is his words. How can we be sure that he didn't try to hack a wordpress site and, when he got busted and his server is shuted down, he just complains to avoid the consequenses of his acts? And, if he is so experienced to secure his server so well to become unhackable, then, how do he explains the lack of knowledge/willing to fix the problem by accessing his server thru ILO?

    The support of a company is responding accordingly to how much do you pay for the product. If you pay $$$$ for a server, then, you expect answers within an hour or less. If you pay $, then, you cannot expect high - priority support. Even more if you bought an unmanaged server. If OP wanted top-noch support, then, he should find a managed service and pay for that.

    IMHO, OP is a bit of smelly...

  • MunMun Member

    @markturner got any promos, ill buy a server thanks to OP. PM me?

  • MarkTurner said: If the OP spent more time dealing with the issue than trying to disparage Delimiter on the forums, then his server would already be back online.

    Look at the OP's history on here: constantly complains about budget providers. He thinks he gets some kind of leverage by "airing out" the company who is allegedly wronging him for his secure server.

    MarkTurner said: it was actually a bruteforce attack against a wordpress site

    I called that one except surprised Kloxo wasn't involved. Please budget providers, MAKE KLOXO AN AUP/TOS OFFENSE! Save the Internet!

    Thanked by 1MarkTurner
  • I'm waiting on a bit more cash flow then I'm ordering another of the Atoms.

    Thanked by 1MarkTurner
  • jarjar Patron Provider, Top Host, Veteran

    Convenient morning for me to get a DDOS. That's all I'm saying. This thread is the only place I've pissed anyone off.

  • MunMun Member

    @Jar said:
    Convenient morning for me to get a DDOS. That's all I'm saying. This thread is the only place I've pissed anyone off.

    "Ohh jar, don't you know I want a date before you screw me like that...."

  • jarjar Patron Provider, Top Host, Veteran

    No way this guy isn't attacking mxroute right now. Two servers down. Congrats kid.

  • Scary that he can't keep a Wordpress install up-to-date but can use a booter

    Thanked by 3jar Pwner KwiceroLTD
  • @Jar said:
    Convenient morning for me to get a DDOS. That's all I'm saying. This thread is the only place I've pissed anyone off.

    Me the same, getting DDOS, but I'm not worry, it seems like DDOS from a kid.

    Thanked by 1jar
  • MunMun Member

    @Jar said:
    No way this guy isn't attacking mxroute right now. Two servers down. Congrats kid.

    How many servers?

  • jarjar Patron Provider, Top Host, Veteran

    @Mun said:
    How many servers?

    I'm going to refrain from answering that here. I'll just wave a white flag.

    I'm sorry for offending you, kid. Let people have their email now.

  • DeanDean Member
    edited January 2015

    So if this kid is the one DDosing, then Delimeter knows who he is right? He will have had to use genuine details to sign up.

  • @DeanClinton said:
    So if this kid is the one DDosing, then Delimeter knows who he is right? He will have had to use genuine details to sign up.

    So what are you suggesting?
    Let's all call his mom and complaint?
    Nah... That'ld devastate him.

  • nggabernggaber Member
    edited January 2015

    @4n0nx said:

    Including DDoS-ing other poster here?

Sign In or Register to comment.