Forum Site Speed

[Funkycowie]

Having spent time looking through the logs at that time it is apparent there is a high amount of attempt SSH login attemps from random usernames and multiple IP Addresses so the site appears to be under a brute force attack constantly between 06:30 and 10:30, those 100% CPU load times... I have increased the IP banning legth of time from 600 seconds to 1440 and hopefully this will act as a deterrent. I'll keep monitoring it.

[mottza]

Thanks for looking at this. Is it coming from any region and can that be blocked. Does the hosting company offer any ddos protection?

[Funkycowie]

Now high load time has shifted to 06:00 - 14:00, but it looks better than it was... yes there is ddos protection to a degree but its not great, I am going to review the logs this weekend to see if it is region specific.

[Funkycowie]

South Korea, China, UK, US, Japan... Tencent Cloud Computing

Vietnam... Vietnam Posts And Telecommunications Group

Russia... Chang Way Technologies Co. Limited

[Funkycowie]

I've set it so that it bans IP's for 24 hours if a retry is performed within 24 hours with 1 retry... for some reason it won't let me do 0 retries. There is also now lots of attempts to log in to email accounts that don't exist and the hosting account...

[mottza]

Thanks for looking into this Peter. Funnily enough dealing with a ddos at work at the moment.

[Funkycowie]

Ok, found the culprit, I'll work on a solution later today, just need to research on how to make some amends.

[Funkycowie]

Seems like it could be corrupt

https://support.plesk.com/hc/en-us/arti ... esk-server

[Funkycowie]

ok... so I have removed awstats, I never used it anyway, then I also did some house work... hopefully tomorrow the server will not be at 100% between 06:00 and 13:00

[Funkycowie]

Side by side comparison of yesterday vs today, looks like I fixed it!