Bandwidth Limit Exceeded

templest

Dec 23 2004, 02:56 PM

I was supposed to have 1GB of bandwidth, when I went to sleep, I remember just logging out of my cPanel and having consumed ~30MBs. Which isn't even 3% of my total allowed bandwidth. So, did someone find out my FTP password and purposely take down my site, or someone abused the upload feature on the forum and uploaded it to death? (mind you, there was a 2MB upload limit for all accounts, and only 30MBs of the total account space was allocated for uploads. Therefore, someone had to have made 500 accounts and uploaded around 966.66 MBs worth of files in order to do that, which again, is impossible due to the fact that I only have 50MBs of space to work with).

I can't help but think some error has occured here.

Comment/Reply (w/o sign-up)

wassie

Dec 23 2004, 03:46 PM

------------------------------------------------------------------------
Files type Hits Percent Bandwidth Percent
jpg Image 18846 52.3 % 1.27 GB 96.3 %
------------------------------------------------------------------------

so some people really want to check out our picture

Comment/Reply (w/o sign-up)

templest

Dec 23 2004, 03:53 PM

wtf? So someone screwed over my site by refreshing that page several thousand times, over and over again? Wicked!

I need a better hosting plan.

Comment/Reply (w/o sign-up)

OpaQue

Dec 23 2004, 06:27 PM

Well done Wassie.. thanks for solving the issue.
As for you, Templest, you are not much online. And also someone is abusing your account. If this happens again, We will be forced to permanently suspend your site. We cannot allow other accounts to suffer because of one. Here, we expect members to share the server resources peacefully and enjoy their hosting.
You have been warned!

Comment/Reply (w/o sign-up)

templest

Dec 23 2004, 08:00 PM

Suspend my account because someone is abusing the account? This hardly seems fair. It's not like I'm willfully jacking system resources, someone decided to screw me. Instead of blatantly reciting threats to the members of the service you are providing them with, why not find out how they managed to screw us* and find out a way to stop it, so that other members don't have to be bothered by the same problem?

*= I say "us", because they're not just screwing me. Like you said, they did take down my site, and apperantly are disturbing other site's resources. So it's not just me who should be worried about this.

And while we're on the subject, a friend registered to me forums and I got a bounce from his ISP saying that it wouldn't accept incoming emails from Trap17.com address', because this server is easily hackable. I quote: "possible root-kit installed".

So by the look of things, there's much more bigger issues at hand than banning users for things they did not cause.

Comment/Reply (w/o sign-up)

templest

Dec 23 2004, 08:13 PM

In fact, OpaQue, here's the two emails I recieved, I'm assuming, right before the site ran out of bandwidth. It appears as though someone did intentionally sabotage my website. These two emails clearly show that someone was making account in spam form, and doing something much more than just looking at that picture.

QUOTE("Email 1")

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

Weber754@hotmail.com
SMTP error from remote mailer after RCPT TO:<Weber754@hotmail.com>:
host mx3.hotmail.com [64.4.50.239]: 550 Requested action not taken:
mailbox unavailable

------ This is a copy of the message, including all the headers. ------

Return-path: <templest@xiplst.uni.cc>
Received: from [69.50.188.18] (port=36218 helo=xiplst.uni.cc)
by rhino.unixbsd.info with esmtpa (Exim 4.43)
id 1ChPfA-0007kE-V2
for Weber754@hotmail.com; Thu, 23 Dec 2004 01:53:41 -0800
Subject: Welcome to ximbio -Labs Forums
To: Weber754@hotmail.com
Reply-to: templest@xiplst.uni.cc
From: templest@xiplst.uni.cc
Message-ID: <70cd2efebcf48d9046d276edb9abe4ee@xiplst.uni.cc>
MIME-Version: 1.0
Content-type: text/plain; charset=iso-8859-1
Content-transfer-encoding: 8bit
Date: Thu, 23 Dec 2004 01:53:40 -0800
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: PHP
X-MimeOLE: Produced By phpBB2
X-Antivirus-Scanner: Clean mail though you should still use an Antivirus

Welcome to ximbio -Labs Forums

Please keep this email for your records. Your account information is as follows:

----------------------------
Username: Weber754
Password: qo9iuTY8
----------------------------

Your account is currently inactive. You cannot use it until you visit the following link:

http://xiplst.uni.cc/xlabs/profile.php?mod...d0b1aec3307a2f2

Please do not forget your password as it has been encrypted in our database and we cannot retrieve it for you. However, should you forget your password you can request a new one which will be activated in the same way as this account.

Thank you for registering.

-- Thanks, ximbio -Labs Management. http://xiplst.uni.cc/

QUOTE("Email 2")

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

Weber737@hotmail.com
SMTP error from remote mailer after RCPT TO:<Weber737@hotmail.com>:
host mx2.hotmail.com [65.54.166.230]: 550 Requested action not taken:
mailbox unavailable

------ This is a copy of the message, including all the headers. ------

Return-path: <templest@xiplst.uni.cc>
Received: from [69.50.188.18] (port=36201 helo=xiplst.uni.cc)
by rhino.unixbsd.info with esmtpa (Exim 4.43)
id 1ChPew-0007jM-ST
for Weber737@hotmail.com; Thu, 23 Dec 2004 01:53:26 -0800
Subject: Welcome to ximbio -Labs Forums
To: Weber737@hotmail.com
Reply-to: templest@xiplst.uni.cc
From: templest@xiplst.uni.cc
Message-ID: <120c1ad738aec823ef3fef80e872e035@xiplst.uni.cc>
MIME-Version: 1.0
Content-type: text/plain; charset=iso-8859-1
Content-transfer-encoding: 8bit
Date: Thu, 23 Dec 2004 01:53:26 -0800
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: PHP
X-MimeOLE: Produced By phpBB2
X-Antivirus-Scanner: Clean mail though you should still use an Antivirus

Welcome to ximbio -Labs Forums

Please keep this email for your records. Your account information is as follows:

----------------------------
Username: Weber737
Password: qo9iuTY8
----------------------------

Your account is currently inactive. You cannot use it until you visit the following link:

http://xiplst.uni.cc/xlabs/profile.php?mod...17693d7fde39a62

Please do not forget your password as it has been encrypted in our database and we cannot retrieve it for you. However, should you forget your password you can request a new one which will be activated in the same way as this account.

Thank you for registering.

-- Thanks, ximbio -Labs Management. http://xiplst.uni.cc/

Comment/Reply (w/o sign-up)

ashiezai

Dec 25 2004, 09:47 AM

erm .. y dont u check wat ip was that n ban that ip from visiting ur site ?

Comment/Reply (w/o sign-up)

templest

Dec 25 2004, 04:11 PM

QUOTE (ashiezai @ Dec 25 2004, 09:47 AM)

erm .. y dont u check wat ip was that n ban that ip from visiting ur site ?

Hey! What an awsome idea! Wow! That's such amazing insight! I would have never thought of that! I'll remember to do that, right when my site goes back up again!. Which should be six days from now.

Comment/Reply (w/o sign-up)

Mike

Dec 25 2004, 05:03 PM

OpaQue: I think you spelt 'clarify' wrong on the top of the site wrong.

Oh and templest, how could you let it get that bad? You should have been able to figure out somebody was screwing your site up before. Then you should have gone into your cPanel and looked at the little 'Last Visited By' thing and used the IP Deny Manager to block the IP shown. Also, I don't even understand hackers. They find it fun to mess around with peoples' things. Ugh. >_<

Comment/Reply (w/o sign-up)

templest

Dec 25 2004, 06:07 PM

QUOTE (Mike @ Dec 25 2004, 05:03 PM)

OpaQue: I think you spelt 'clarify' wrong on the top of the site wrong.

How could I let it get that bad? Here's a thought: Do you know what sleep is? You know, that thing you do about eight hours a day, when you don't move and have no idea about what's going around you because you're dreaming about having sex with that cute girl you saw at school the other day? Well, that's what I was doing when someone was bombing my site. I'm sure it took a lot less than eight hours to set-up a bot and make accounts on a PhpBB2 forum in droves whilst refreshing a page with a 200KB image on it.

My solution? Have the host build some sort of script, where it won't let IPs refresh a page more than twice a minute. Sure, you can refresh different pages, but not the same one. People would still be able to go back to the page, because you'd be using the browser's cache to se the images. But if someone clears the cache and tries to reload the page, it'll just give them a little-red-"x".

Comment/Reply (w/o sign-up)

Bandwidth Limit Exceeded - Hm?

Bandwidth Limit Exceeded - Hm?