Nightly Site Attack

[rh2004]

Hello,

I have a board, and between 6.30 - 7PM the site under goes an attack (not sure the type of attack), but around a month ago the site underwent a dos attack direct to this site, and now every night between the above times the server hits 50-90CPU.

This lasts around 15-30 min's, I've tried a dedicated server and it had the same problem's.

[Zachery]

Who are you hosted with? You should contact your DC

[Icheb]

Does your traffic usage also go up during that time? If so, you probably have a worm / whatever on your server that is attacking other servers.

[rh2004]

It happens on every site, could the board have caught something at all. I moved host twice in 2 days

Datacentre couldn't do anything either. All I receive from hosts is that the CPU goes up between these times


I have tried coreix, interserver and theplanet

[Icheb]

One thing that comes to mind are the vB cronjobs executing scripts at those times when it's likely not the server itself causing this. Try looking through them and see if there's something unusual?

[rh2004]

Yeah but to take a CPU upto this level on a cronjob takes just a bit.

What can I do to work this out, because im totally amazed

[Steve Machol]

Do you have any server cron jobs running during that time?

[rh2004]

No cron jobs running on any of the servers

[Zachery]

RH, do you have any security measures in place? Firewall? AntiDDOS? Bruteforce protection?

[rh2004]

Yes but I'm talking about third party hosts at the moment, now I did notice quite an increase in CPU yesterday shortly after uploading the database and enabing the site.

So where do I look, or start to look to find out the problem. I don't think I saw anything different or unusual when I looked at the vb cron's

[rh2004]

Here are the vb cron's

[Steve Machol]

The vB crons would not cause this. Personally I think the most likely cause is s some server cron jobs since the timing is the same every day, but you said you have ruled that out.

[rh2004]

Yes I am going to try and scrap everything and start with a new import as the board is still on 3.0.3, I am unable to see the Import / Export when I uploaded the impex to /impex

If I type /impex/ I receive a white page.

[Zachery]

I thought you were on a dedicated server?

If you are, have you installed a good firewall and Bruteforce system?

[rh2004]

That was a number of month's ago It had a direct dos attack so I moved to shared since

And yes the dedicatd has the above