So, what happened?

Discussion in 'Water Cooler' started by MordyT, Jun 30, 2010.

  1. MordyT

    MordyT Grand Master

    Is it just me, or was AA down for a good 24 hours?
    I am guessing a database crash, only because the "contact us" page isn't working...
    However no threads appeared as to why the downtime, so I am wondering :confused:
     
  2. John

    John Regular Member

    For a while I saw an message that they had moved to a new server and was waiting for the dns to take full change.
     
  3. gnatster

    gnatster Regular Member

    Picture virus ;)
     
  4. Dan Hutter

    Dan Hutter aka Big Dan

    Nick just moved to a new server, AFAIK
     
  5. Nick

    Nick Regular Member

    Yep, it was just a server move. Nothing major! :)
     
  6. Abomination

    Abomination Zealot

    Seez you.

    If it wasn't for Brandon suggesting I should use another browser I still would not have gotten in.

    I keep getting a "Parallels H-Sphere" page from my main computer, any suggestions? I did clear my cache and that did not help.

    Sounds like you moved to a vps.
     
  7. MordyT

    MordyT Grand Master

    Ah, ok, someone was looking to advertise something server related on one of my sites, told him to look here... he mentioned that the advertise link was broken(database error), I thought he was crazy cause I couldn't load the site (well, got closed message)...
     
  8. Abomination

    Abomination Zealot

    I'm still getting the "Parallels H-Sphere" page from my main computer when I try to view this site.

    I am typing on a spare computer, until I can figure out how to access AA from my main computer I won't be logging in much.
     
  9. MordyT

    MordyT Grand Master

    Not saying this will help...

    run from the command line:
    ipconfig /flushdns

    (notice space after ipconfig before the /flushdns ....
     
  10. Abomination

    Abomination Zealot

    didn't help : (
     
  11. MordyT

    MordyT Grand Master

    Sorry to hear that, maybe set up a tinyurl with the sites ip addy and use that on the main computer? Get the ip by pinging the site through the command line...

    Sent from my HTC EvO 4G
     
  12. Abomination

    Abomination Zealot

    I am going straight to the IP address and now it is giving me a different "Parallels H-Sphere" page. It is letting me choose between using phpmyadmin, reading email, and a few other things : D

    ?
     
  13. Abomination

    Abomination Zealot

    I'll keep checking in 2x per day if I remember, from the domain tools.com information it looks like it might be on a busy vps account with 56 sites on it?

    No idea why one computer can reach AA, but my main computer cannot. I would assume others are having problems as well.
     
  14. Brandon

    Brandon Regular Member

    I never did see a "site down" message or anything out of the ordinary.. :ohi:
     
  15. Abomination

    Abomination Zealot

    Do you have any ideas why I might not be able to get to AA from my main computer using FF? I've cleared all private data.

    ?

    I just checked and I can get to AA using IE 6.0 on the main computer, but not FF 3.6.3 which was working fine before.
     
  16. mripguru

    mripguru Newcomer

    I'm checking into this -- however, all seems normal on this end.
     
  17. Abomination

    Abomination Zealot

    I'm not sure who you are, but now the IE on my primary computer keeps getting the parallels page. "Error 400 bad request"

    I am now typing on the secondary computer. If I dissappear off this forum it will probably because I cannot get to it. If people send PMs, because the message is stripped out, I will not see the PM contents.
     
  18. mripguru

    mripguru Newcomer

    Can you try now and see if it'll work? I think I found the issue.
     
  19. Abomination

    Abomination Zealot

    Works great on my primary computer using both FF & IE! Although since the move the forum is a bit slow to respond.

    What was the problem?


    (keep in mind we are all trying to learn about these types of things cause it is an admin forum)
     
  20. mripguru

    mripguru Newcomer

    Are you familiar with mod_security? If so, here's the actual rule that was being triggered:

    [Mon Jul 05 11:09:57 2010] [error] [client 75.36.236.60] ModSecurity: Access denied with code 400 (phase 2). Pattern match "%0[ad]" at REQUEST_HEADERS:Cookie. [file "/hsphere/local/config/httpd2/modsecurity-core-rules/modsecurity_crs_40_generic_attacks.conf"] [line "83"] [id "950910"] [msg "HTTP Response Splitting Attack. Matched signature <%0a>"] [severity "ALERT"] [hostname "adminaddict.net"] [uri "/forum/index.php"] [unique_id "TDID1UMWilwAADMGA0kAAAAI"]

    and

    [Mon Jul 05 08:44:44 2010] [error] [client 93.223.182.80] ModSecurity: Access denied with code 400 (phase 2). Invalid UTF-8 encoding: invalid byte value in character at REQUEST_HEADERS:Cookie. [offset "270"] [file "/hsphere/local/config/httpd2/modsecurity-core-rules/modsecurity_crs_20_protocol_violations.conf"] [line "67"] [id "950801"] [msg "UTF8 Encoding Abuse Attack Attempt"] [severity "WARNING"] [hostname "adminaddict.net"] [uri "/forum/images/vbseo/linkback_url.gif"] [unique_id "TDHhzEMWilwAAEMJpo8AAAAB"]

    which came up in the logs a lot (I would suspect the first is what you got nabbed by). So, I excluded both rules from mod_security and issue resolved.

    :spin:
     

Share This Page