Support

Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? Yes
Have I searched the tickets before posting? Yes
Have I read the documentation before posting (which pages?)? Yes
Joomla! version: 2.5.14
PHP version:5.4.14
MySQL version: (unknown)
Host: FastHosts
Admin Tools version:2.5.6

Description of my issue:

A user notified me this morning that they were receiving the 'please do not try to infiltrate this site' message - they are just a normal user - my site doesn't have registered users apart from myself.

They then called back to say they could access it - and now its off again??

I have now had quite a few calls from different people telling me they can't access the site - all with the same error message?

I can access the site no problem from my office.
Any suggestions please?

http://www.businessdurham.co.uk

Thanks

I got

503 Service Unavailable

No server is available to handle this request.

When I tried.

My first thought was GeoIP blocking, do you have that turned on? Next check your Admin Tools security log to see why the IPs are being blocked. Note that you may have to turn this option on, under WAF Config, towards the bottom of the screen under Logging And Reporting, Log security exceptions should be set to yes.

Dale

Thanks Dale - I don't have geo switched on, and afetr checking the logs there are only a couple of IPs which are blocked for trying to access the login component. I've had 3 different people check all from different parts of the UK and they all get the same message. However after reporting this to fasthosts they tell me that there could be an issue with the server?

They've now restarted server and I now longer get 503, just the infiltrate message?

Another thought

I have Watchful.li installed for remote backups and site monitoring.
Their site is currently down - I wonder if it's pulling my site down too?

checked the logs and it looks like the site has had a DDOS or SSH attack from 10.216.1.71 - which admin tools has blocked. Could this be the reason? What can I do now?

I have had thousands of GET requests in my logs from this IP address today

I'm sorry Andrea, I had a reply get lost. Hopefully I didn't post it to another thread. :)

I can get to the site now, so the DDos attack and the server issue seem to have had some effect on the problem. You can test to see if Admin Tools is the culprit by disabling the System - Admin Tools plugin. That will completely disable AT. If the problem persists, it has nothing to do with AT. I'm not sure you should make that test with a known attack in progress.

Dale

Hi Dale,

Yes FastHosts are onto the problem now - it was nothing really to do with AT apart from anyone who tried to visit the site looked like they were coming from the 10.216.1.71 IP address, hence they were getting blocked. Hopefully it's now resolved!

Thanks

I'm glad you have the problems on the run! You're welcome!