Değişik bir saldırı caps ekledim

Arkadaşlar load 1-2 lerde fakat saldırı geliyor gibi

Load düşüyor apache down oluyor apache restart ediyorum geliyor sonra tekrar load düşüyor apache tekrar down oluyor

WHM den Apache Status'e baktığımda

hep ..reading.. dolu

bu nedir ve nasıl engelleyebilirim teşekkürler

gene kapayıp açtım

0-2 7826 0/0/0 R 0.00 10 0 0.0 0.00 0.00 ? ? ..reading..
1-2 7827 0/0/0 R 0.00 10 0 0.0 0.00 0.00 ? ? ..reading..
2-2 7828 0/0/0 R 0.00 10 0 0.0 0.00 0.00 ? ? ..reading..
3-2 7829 0/0/0 R 0.00 10 0 0.0 0.00 0.00 ? ? ..reading..
4-2 7830 0/0/0 R 0.00 10 0 0.0 0.00 0.00 ? ? ..reading..
5-2 7831 0/0/0 R 0.00 10 0 0.0 0.00 0.00 ? ? ..reading..
6-2 7832 0/0/0 R 0.00 10 0 0.0 0.00 0.00 ? ? ..reading..
7-2 7833 0/0/0 R 0.00 10 0 0.0 0.00 0.00 ? ? ..reading..
8-2 7834 0/0/0 R 0.00 10 0 0.0 0.00 0.00 ? ? ..reading..
9-2 7835 0/0/0 R 0.00 10 0 0.0 0.00 0.00 ? ? ..reading..
10-2 7836 0/0/0 R 0.00 10 0 0.0 0.00 0.00 ? ? ..reading..
11-2 7837 0/0/0 R 0.00 10 0 0.0 0.00 0.00 ? ? ..reading..
12-2 7838 0/0/0 R 0.00 10 0 0.0 0.00 0.00 ? ? ..reading..
13-2 7839 0/0/0 R 0.00 10 0 0.0 0.00 0.00 ? ? ..reading..
14-2 7840 0/0/0 R 0.00 10 0 0.0 0.00 0.00 ? ? ..reading..
15-2 7841 0/0/0 R 0.00 10 0 0.0 0.00 0.00 ? ? ..reading..
16-2 7844 0/0/0 R 0.00 9 0 0.0 0.00 0.00 ? ? ..reading..
17-2 7845 0/0/0 R 0.00 8 0 0.0 0.00 0.00 ? ? ..reading..
18-2 7846 0/0/0 R 0.00 8 0 0.0 0.00 0.00 ? ? ..reading..
19-2 7849 0/0/0 R 0.00 7 0 0.0 0.00 0.00 ? ? ..reading..
20-2 7850 0/0/0 R 0.00 7 0 0.0 0.00 0.00 ? ? ..reading..
21-2 7851 0/0/0 R 0.00 7 0 0.0 0.00 0.00 ? ? ..reading..
22-2 7852 0/0/0 R 0.00 7 0 0.0 0.00 0.00 ? ? ..reading..
23-2 7855 0/0/0 R 0.00 6 0 0.0 0.00 0.00 ? ? ..reading..
24-2 7856 0/0/0 R 0.00 6 0 0.0 0.00 0.00 ? ? ..reading..
25-2 7857 0/0/0 R 0.00 6 0 0.0 0.00 0.00 ? ? ..reading..
26-2 7858 0/0/0 R 0.00 6 0 0.0 0.00 0.00 ? ? ..reading..
27-2 7859 0/0/0 R 0.00 6 0 0.0 0.00 0.00 ? ? ..reading..
28-2 7860 0/0/0 R 0.00 6 0 0.0 0.00 0.00 ? ? ..reading..
29-2 7861 0/1/1 R 0.00 6 1 0.0 0.00 0.00 ? ? ..reading..
30-2 7862 0/0/0 R 0.00 6 0 0.0 0.00 0.00 ? ? ..reading..
31-2 7863 0/0/0 R 0.00 5 0 0.0 0.00 0.00 ? ? ..reading..
32-2 7864 0/0/0 R 0.00 5 0 0.0 0.00 0.00 ? ? ..reading..
33-2 7865 0/0/0 R 0.00 5 0 0.0 0.00 0.00 ? ? ..reading..
34-2 7866 0/0/0 R 0.00 5 0 0.0 0.00 0.00 ? ? ..reading..
35-2 7867 0/0/0 R 0.00 5 0 0.0 0.00 0.00 ? ? ..reading..
36-2 7868 0/0/0 R 0.00 5 0 0.0 0.00 0.00 ? ? ..reading..
37-2 7869 0/0/0 R 0.00 5 0 0.0 0.00 0.00 ? ? ..reading..
38-2 7870 0/0/0 R 0.00 5 0 0.0 0.00 0.00 ? ? ..reading..
39-2 7871 0/2/2 R 0.00 4 407 0.0 0.03 0.03 ? ? ..reading..
40-2 7872 0/0/0 R 0.00 5 0 0.0 0.00 0.00 ? ? ..reading..
41-2 7873 0/0/0 R 0.00 5 0 0.0 0.00 0.00 ? ? ..reading..
42-2 7874 0/0/0 R 0.00 5 0 0.0 0.00 0.00 ? ? ..reading..
43-2 7875 0/0/0 R 0.00 5 0 0.0 0.00 0.00 ? ? ..reading..
44-2 7876 0/0/0 R 0.00 5 0 0.0 0.00 0.00 ? ? ..reading..
45-2 7877 0/0/0 R 0.00 5 0 0.0 0.00 0.00 ? ? ..reading..
46-2 7878 0/0/0 R 0.00 5 0 0.0 0.00 0.00 ? ? ..reading..
47-2 7879 0/0/0 R 0.00 4 0 0.0 0.00 0.00 ? ? ..reading..
48-2 7880 0/0/0 R 0.00 4 0 0.0 0.00 0.00 ? ? ..reading..
49-2 7881 0/0/0 R 0.00 4 0 0.0 0.00 0.00 ? ? ..reading..
50-2 7882 0/0/0 R 0.00 4 0 0.0 0.00 0.00 ? ? ..reading..
51-2 7883 0/0/0 R 0.00 4 0 0.0 0.00 0.00 ? ? ..reading..
52-2 7884 0/0/0 R 0.00 4 0 0.0 0.00 0.00 ? ? ..reading..
53-2 7885 0/0/0 R 0.00 4 0 0.0 0.00 0.00 ? ? ..reading..
54-2 7886 0/0/0 R 0.00 4 0 0.0 0.00 0.00 ? ? ..reading..
55-2 7887 0/0/0 R 0.00 4 0 0.0 0.00 0.00 ? ? ..reading..
56-2 7888 0/0/0 R 0.00 4 0 0.0 0.00 0.00 ? ? ..reading..
57-2 7889 0/0/0 R 0.00 4 0 0.0 0.00 0.00 ? ? ..reading..

ssh den bu komutun çıktısı nedir ?

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

Genişletmek için tıkla ...

kardeşim bu juno denilen bir exploitle yapılan bir saldırı linux server üzerinde root yetkisiyle çalıştırılıyor direk sunucu hattına ordan apacheye saldırıyor ve saldıran ip falan görünmüyor çözümü yok gibi bişi zamanında bizde aldık bu saldırıyı hattı 50-60 mbit e kadar çıkartabilen bir saldırı bırak apache yi 100 mbit hat bile dayanmıyor

kurduğun bir script varsa ona dikkat et onunla birlikte eklenti kurulmuştur domainin için shell iznini kapat root'tan işini gör.