Page 1 of 2

Servers offline?

Posted: Wed Jan 11, 2012 12:17 pm
by Lancer
Red square, and 0/0 on GT.

How come?

Posted: Wed Jan 11, 2012 1:15 pm
by valentin54
I got Rotacak on RCZ, just told him that it was off but he was afk :/

Posted: Wed Jan 11, 2012 1:21 pm
by [{USATREM}] !Gunther!
Check the Maps section and then page 8 of the first Sticky called "Avalible maps on server"
Rotacak said he added "fun-mod" and also a download link.

Maybe that why server offline?

Posted: Wed Jan 11, 2012 1:25 pm
by Lancer
On both servers?
Thats kind of weird does it, might be so...hope the gameplay doesn't change :- ).

Posted: Wed Jan 11, 2012 2:06 pm
by valentin54
Dudes it's the fun mode I found for servers !

And no, it just adds some stuffs (Blue armoury, blue medi, yellow marauder, multi-color lucishot, etc.)

So, it's not the origin of that problem

Posted: Wed Jan 11, 2012 2:33 pm
by Lancer
Also on RCZ 1.2?

Posted: Wed Jan 11, 2012 3:01 pm
by Rotacak
I got this email:
Your IP 46.28.108.190 attacked xat.com with udp packets as part of a
co-ordinated DDOS attack.

If you are running a game server this may be useful:
There is a known exploit with the "quake engine" used by various FPS type
games.
Your server may be being used for a Distributed Reflection Denial of
Service attack. eg:
- Attacker spoofs some packets (with our server ip) and asks gameserver to
send all server information (about 2k of data)
- gameserver sends all server information (500k of data)
- Attacker repeats for thousands of gameservers

If you are running a DNS server it may be being used for a reflection
attack. This may be useful:
http://www.shortestpathfirst.net/2009/1 ... g-attacks/
Please contact me to confirm that you have addressed this matter and that
action will be taken against your customer/compromised machine and this
server will be taken down to prevent a repeat of this illegal activity.

Posted: Wed Jan 11, 2012 3:33 pm
by valentin54
Please contact me to confirm that you have addressed this matter and that
action will be taken against your customer/compromised machine and this
server will be taken down to prevent a repeat of this illegal activity.

WHATA LE FUCKA ?

Posted: Wed Jan 11, 2012 4:04 pm
by Lancer
So, someone has something against RCZ.

Posted: Wed Jan 11, 2012 4:21 pm
by Redman
I've found some similar e-mails:

Code: Select all

Your IP 46.182.120.203 attacked wrestlinghub with udp packets as part of a
co-ordinated DDOS attack.

Estimated bandwidth: 426 Mb/s

I need you to contact me to confirm that you have addressed this matter and
that action will be taken against your customer/compromised machine and this
server will be taken down to prevent a repeat of this illegal activity.

I look forward to hearing from you as a matter of urgency.

Richard
xat.com

Code: Select all

Your IP 188.138.116.207 attacked xat.com with udp packets as part of a 
co-ordinated DDOS attack.

Estimated bandwidth: 4 Mb/s

We got this from another host and it might prove useful:
"After investigation we found out that the attacker exploited a 
vulnerability in the Call of Duty 2 server code, which is , as of now still 
not patched by Acitivision. We're looking into filtering this specific type 
of traffic outgoing
untill the developers come up with a fix

Code: Select all

One of them is running Windows Server 2008, and I got an email this morning that it was being used in a coordinated DDOS attack using UDP 1500 Byte packets against xat.com (217.23.3.215).
What the fuck is this?

Posted: Wed Jan 11, 2012 4:57 pm
by [{USATREM}] !Gunther!
It's easy good chaps.

WE'VE BEEN HACKED

Haters gonna hate, and looks like somebody want to do a bit more than just bot.
Maybe that's how they got the bot to work....

And yes Val I got the fun-mod and it looks like some cooool colors.

Posted: Wed Jan 11, 2012 5:05 pm
by Rotacak
And it was from Funserver, not 1.2.

Posted: Wed Jan 11, 2012 5:23 pm
by [{USATREM}] !Gunther!
Well lads, it's been fun.... :(

Posted: Wed Jan 11, 2012 5:26 pm
by [{USATREM}] !Gunther!
And um?
Xat.com is a stinkin chatroon?????
WHA DA FU???

Posted: Wed Jan 11, 2012 5:28 pm
by Lancer
Servers are infected - part of a botnet?