Hello Jose We have been using and testing aaPanel for a few months now, so far there have been no complaints, but now there is a serious problem that is caused by an extremely large number of attacks from the network and IP inventory baidu.com and so on is in turn connected to BaoTa which is a fork of BaoTa. This post is about tracking aaPanel https://www.aapanel.com/forum/d/1504-about-the-tracking-code-of-the-aapanel-installation-script/6 So please openly and transparently these tracking codes are used to attack web servers. There is no other way to explain it, 90% of the IPs that attack our systems are from this network and all of our customers are currently experiencing the same problems! So please comment on this

This news is very dangerous for us

[unknown] baidu and bt.cn both are chinese!!!

lol... share more details about the attack (port, dest, layer, examples?). how are you relating these ip's with baota/aapanel? where are the proofs of what you're saying?

We use various tools and we have a firewall from its log, we can see where the attacks come from, plus some other network monitoring tools and you can use this to determine where and from which network the IPs come. https://www.ultratools.com/tools/ipWhoisLookup but we still have many far-reaching options that I do not want to explain further here (company secrets). Source: whois.apnic.netIP Address: 106.12.215.244 % [whois.apnic.net] % Whois data copyright terms http://www.apnic.net/db/dbcopyright.html % Information related to '106.12.0.0 - 106.13.255.255' % Abuse contact for '106.12.0.0 - 106.13.255.255' is ' ipas@cnnic.cn ' inetnum: 106.12.0.0 - 106.13.255.255 netname: Baidu descr: Beijing Baidu Netcom Science and Technology Co., Ltd. descr: Baidu Plaza, No.10, Shangdi 10th street, descr: Haidian District Beijing, 100080 admin-c: SD753-AP tech-c: SD753-AP country: CN mnt-by: MAINT-CNNIC-AP mnt-lower: MAINT-CNNIC-AP mnt-irt: IRT-CNNIC-CN mnt-routes: MAINT-CNNIC-AP status: ALLOCATED PORTABLE last-modified: 2015-01-28T09: 58: 01Z source: APNIC irt: IRT-CNNIC-CN address: Beijing, China e-mail: ipas@cnnic.cn abuse-mailbox: ipas@cnnic.cn admin-c: IP50-AP tech-c: IP50-AP auth: # Filtered remarks: Please note that CNNIC is not an ISP and is not remarks: empowered to investigate complaints of network abuse. remarks: Please contact the tech-c or admin-c of the network. mnt-by: MAINT-CNNIC-AP last-modified: 2017-11-01T08: 57: 39Z source: APNIC person: Supeng Deng nic-hdl: SD753-AP address: No.6 2nd North Street Haidian District Beijing country: CN phone: + 86-10-58003402 fax-no: + 86-10-58003402 e-mail: zhangyukun@baidu.com mnt-by: MAINT-CNNIC-AP last-modified: 2016-11-01T08: 04: 01Z source: APNIC % Information related to '106.12.192.0/18AS38365' route: 106.12.192.0/18 descr: Baidu country: CN origin: AS38365 notify: zhangyukun@baidu.com mnt-by: MAINT-CNNIC-AP last-modified: 2017-12-21T08: 06: 02Z source: APNIC % Information related to '106.12.192.0/18AS55967' route: 106.12.192.0/18 descr: Baidu country: CN origin: AS55967 notify: zhangyukun@baidu.com mnt-by: MAINT-CNNIC-AP last-modified: 2017-12-21T08: 06: 02Z source: APNIC % This query was served by the APNIC Whois Service version 1.88.15-SNAPSHOT (WHOIS-US4) almost all attacks come from the network from 106.12.0.0 - 106.13.255.255 and a few more of which we trace up to netname: Baidu descr: Beijing Baidu Netcom Science and Technology Co., Ltd. descr: Baidu Plaza, No.10, Shangdi 10th street, descr: Haidian District Beijing, 100080 could trace back, using vpn / proxyserver.

this is just a small excerpt, we can count thousands of attacks from this and last month. almost all of them went from the IP range 106.12.0.0 to 106.12.255.255 from the area of Haidian District Beijing, 100080 2020-06-14 23:48:02 94.102.56.151 Received / blocked user_agent 2020-06-14 23:47:58 94.102.56.151 Received / blocked user_agent 2020-06-14 20:44:14 174.86.121.243 Get /configuration.php.swp Blocked 2020-06-14 20:44:07 84.138.42.168 received /configuration.php blocked url 2020-06-14 20:43:57 19.153.97.227 Obtained /configuration.php.bak Blocked 2020-06-14 20:43:54 108.208.61.1 Get /configuration.php.old Blocked

block this IP class + use Fail2Ban for all services + use CloudFlare to proxy all websites on server

KrzysztofMaciejewski it's about aaPanel being used to hack servers, I can't tell my customers what and who to block, I recommend it to everyone. Do you have any other questions from Germany? Hesse?

i dont see any proof - its normal attack from "friendly" country could happen to anyone

Hello CQT We have no collecting other information other than collecting the installation information stated in the above post. Do you see any attacks against the panel? If it is, I think it is just a normal scanner scan

so because is a chinese ip you think is aapanel the source? .... ok XD anyway i still don't see any proof

Hacking attacks with and through aaPanel

CQT

So for first aid we prepared and exported our firewall rule, which everyone can easily import via the sys firewall:

[{"id": 101, "types": "drop", "address": "106.13.82.54", "brief": "", "addtime": "2020-07-17 18:19:13"}, {"id": 100, "types": "drop", "address": "114.67.113.78", "brief": "", "addtime": "2020-07-17 18:18:59"}, {"id": 99, "types": "drop", "address": "49.235.141.203", "brief": "", "addtime": "2020-07-17 18:18:44"}, {"id": 98, "types": "drop", "address": "203.195.235.135", "brief": "", "addtime": "2020-07-17 18:18:30"}, {"id": 97, "types": "drop", "address": "107.170.104.125", "brief": "", "addtime": "2020-07-17 18:18:14"}, {"id": 96, "types": "drop", "address": "1.204.116.48", "brief": "", "addtime": "2020-07-17 18:17:59"}, {"id": 95, "types": "drop", "address": "159.65.158.30", "brief": "", "addtime": "2020-07-17 18:17:45"}, {"id": 94, "types": "drop", "address": "218.94.156.130", "brief": "", "addtime": "2020-07-17 18:17:31"}, {"id": 93, "types": "drop", "address": "205.185.123.139", "brief": "", "addtime": "2020-07-17 18:17:17"}, {"id": 92, "types": "drop", "address": "121.204.185.106", "brief": "", "addtime": "2020-07-17 18:17:02"}, {"id": 91, "types": "drop", "address": "37.49.224.65", "brief": "", "addtime": "2020-07-17 18:16:49"}, {"id": 90, "types": "drop", "address": "207.244.247.251", "brief": "", "addtime": "2020-07-17 18:15:24"}, {"id": 89, "types": "drop", "address": "51.75.171.171", "brief": "", "addtime": "2020-07-17 18:15:10"}, {"id": 88, "types": "drop", "address": "180.250.248.169", "brief": "", "addtime": "2020-07-17 18:14:55"}, {"id": 87, "types": "drop", "address": "205.185.115.40", "brief": "", "addtime": "2020-07-17 18:14:42"}, {"id": 86, "types": "drop", "address": "154.204.27.249", "brief": "", "addtime": "2020-07-17 18:14:28"}, {"id": 85, "types": "drop", "address": "84.124.204.154", "brief": "", "addtime": "2020-07-17 18:14:14"}, {"id": 84, "types": "drop", "address": "106.124.135.232", "brief": "", "addtime": "2020-07-17 18:14:00"}, {"id": 83, "types": "drop", "address": "49.234.122.94", "brief": "", "addtime": "2020-07-17 18:13:46"}, {"id": 82, "types": "drop", "address": "144.172.73.40", "brief": "", "addtime": "2020-07-17 18:13:30"}, {"id": 81, "types": "drop", "address": "222.186.15.158", "brief": "", "addtime": "2020-07-17 18:13:17"}, {"id": 80, "types": "drop", "address": "128.199.100.254", "brief": "", "addtime": "2020-07-17 18:13:01"}, {"id": 79, "types": "drop", "address": "207.244.247.192", "brief": "", "addtime": "2020-07-17 18:12:47"}, {"id": 78, "types": "drop", "address": "122.51.66.219", "brief": "", "addtime": "2020-07-17 18:12:33"}, {"id": 77, "types": "drop", "address": "114.67.102.106", "brief": "", "addtime": "2020-07-17 18:12:18"}, {"id": 76, "types": "drop", "address": "49.234.83.240", "brief": "", "addtime": "2020-07-17 18:12:03"}, {"id": 75, "types": "drop", "address": "223.167.13.128", "brief": "", "addtime": "2020-07-17 18:11:47"}, {"id": 74, "types": "drop", "address": "119.45.114.87", "brief": "", "addtime": "2020-07-17 18:11:32"}, {"id": 73, "types": "drop", "address": "120.201.125.204", "brief": "", "addtime": "2020-07-17 18:11:19"}, {"id": 72, "types": "drop", "address": "150.129.67.50", "brief": "", "addtime": "2020-07-17 18:11:05"}, {"id": 71, "types": "drop", "address": "144.172.79.8", "brief": "", "addtime": "2020-07-17 18:10:51"}, {"id": 70, "types": "drop", "address": "45.162.216.10", "brief": "", "addtime": "2020-07-17 18:10:36"}, {"id": 69, "types": "drop", "address": "106.75.13.192", "brief": "", "addtime": "2020-07-17 18:10:20"}, {"id": 68, "types": "drop", "address": "222.186.30.218", "brief": "", "addtime": "2020-07-17 18:10:06"}, {"id": 67, "types": "drop", "address": "222.186.52.39", "brief": "", "addtime": "2020-07-17 18:09:52"}, {"id": 66, "types": "drop", "address": "219.250.188.165", "brief": "", "addtime": "2020-07-17 18:09:38"}, {"id": 65, "types": "drop", "address": "168.197.31.14", "brief": "", "addtime": "2020-07-17 18:09:24"}, {"id": 64, "types": "drop", "address": "144.172.73.41", "brief": "", "addtime": "2020-07-17 18:09:10"}, {"id": 63, "types": "drop", "address": "118.89.69.159", "brief": "", "addtime": "2020-07-17 18:08:55"}, {"id": 62, "types": "drop", "address": "82.118.236.186", "brief": "", "addtime": "2020-07-17 18:08:42"}, {"id": 61, "types": "drop", "address": "112.35.57.139", "brief": "", "addtime": "2020-07-17 18:08:28"}, {"id": 60, "types": "drop", "address": "50.70.229.239", "brief": "", "addtime": "2020-07-17 18:08:13"}, {"id": 59, "types": "drop", "address": "85.209.0.103", "brief": "", "addtime": "2020-07-17 18:07:58"}, {"id": 58, "types": "drop", "address": "37.49.224.39", "brief": "", "addtime": "2020-07-17 18:07:40"}, {"id": 57, "types": "drop", "address": "218.92.0.216", "brief": "", "addtime": "2020-07-17 18:07:25"}, {"id": 56, "types": "drop", "address": "58.246.94.230", "brief": "", "addtime": "2020-07-17 18:07:10"}, {"id": 55, "types": "drop", "address": "144.172.79.7", "brief": "", "addtime": "2020-07-17 18:06:56"}, {"id": 54, "types": "drop", "address": "220.78.28.68", "brief": "", "addtime": "2020-07-17 18:06:42"}, {"id": 53, "types": "drop", "address": "124.30.44.214", "brief": "", "addtime": "2020-07-17 18:06:28"}, {"id": 52, "types": "drop", "address": "51.178.55.92", "brief": "", "addtime": "2020-07-17 18:06:14"}, {"id": 51, "types": "drop", "address": "222.186.30.167", "brief": "", "addtime": "2020-07-17 18:05:15"}, {"id": 50, "types": "drop", "address": "186.147.129.110", "brief": "", "addtime": "2020-07-17 18:05:02"}, {"id": 49, "types": "drop", "address": "117.50.8.61", "brief": "", "addtime": "2020-07-17 18:02:00"}, {"id": 48, "types": "drop", "address": "181.30.99.114", "brief": "", "addtime": "2020-07-17 18:01:35"}, {"id": 47, "types": "drop", "address": "222.186.31.166", "brief": "", "addtime": "2020-07-17 18:01:20"}, {"id": 46, "types": "drop", "address": "115.78.4.219", "brief": "", "addtime": "2020-07-17 17:59:43"}, {"id": 45, "types": "drop", "address": "218.255.86.106", "brief": "", "addtime": "2020-07-17 17:59:27"}, {"id": 44, "types": "drop", "address": "222.186.15.115", "brief": "", "addtime": "2020-07-17 17:59:13"}, {"id": 43, "types": "drop", "address": "222.186.42.137", "brief": "", "addtime": "2020-07-17 17:59:00"}, {"id": 42, "types": "drop", "address": "218.92.0.223", "brief": "", "addtime": "2020-07-17 17:58:46"}, {"id": 41, "types": "drop", "address": "216.83.45.162", "brief": "", "addtime": "2020-07-17 17:58:32"}, {"id": 40, "types": "drop", "address": "218.92.0.221", "brief": "", "addtime": "2020-07-17 17:58:18"}, {"id": 39, "types": "drop", "address": "111.229.176.206", "brief": "", "addtime": "2020-07-17 17:53:37"}, {"id": 38, "types": "drop", "address": "222.186.30.76", "brief": "", "addtime": "2020-07-17 17:53:24"}, {"id": 37, "types": "drop", "address": "218.92.0.219", "brief": "", "addtime": "2020-07-17 17:53:05"}, {"id": 36, "types": "drop", "address": "222.186.42.155", "brief": "", "addtime": "2020-07-17 17:52:51"}, {"id": 35, "types": "drop", "address": "222.186.30.112", "brief": "", "addtime": "2020-07-17 17:52:02"}, {"id": 34, "types": "drop", "address": "94.172.225.26", "brief": "", "addtime": "2020-07-17 17:51:49"}, {"id": 33, "types": "drop", "address": "218.92.0.215", "brief": "", "addtime": "2020-07-17 17:51:33"}, {"id": 32, "types": "drop", "address": "93.146.233.226", "brief": "", "addtime": "2020-07-17 17:51:19"}, {"id": 31, "types": "drop", "address": "193.70.12.219", "brief": "", "addtime": "2020-07-17 17:51:05"}, {"id": 30, "types": "drop", "address": "112.17.184.171", "brief": "", "addtime": "2020-07-17 17:50:51"}, {"id": 29, "types": "drop", "address": "222.186.31.83", "brief": "", "addtime": "2020-07-17 17:50:37"}, {"id": 28, "types": "drop", "address": "222.186.42.136", "brief": "", "addtime": "2020-07-17 17:50:22"}, {"id": 27, "types": "drop", "address": "218.92.0.220", "brief": "", "addtime": "2020-07-17 17:50:08"}, {"id": 26, "types": "drop", "address": "36.111.171.108", "brief": "", "addtime": "2020-07-17 17:49:55"}, {"id": 25, "types": "drop", "address": "119.18.194.168", "brief": "", "addtime": "2020-07-17 17:49:42"}, {"id": 24, "types": "drop", "address": "222.186.190.14", "brief": "", "addtime": "2020-07-17 17:49:28"}, {"id": 23, "types": "drop", "address": "222.186.42.7", "brief": "", "addtime": "2020-07-17 17:49:13"}, {"id": 22, "types": "drop", "address": "222.186.180.142", "brief": "", "addtime": "2020-07-17 17:48:59"}, {"id": 21, "types": "drop", "address": "109.115.187.31", "brief": "", "addtime": "2020-07-17 17:48:45"}, {"id": 20, "types": "drop", "address": "222.186.30.57", "brief": "", "addtime": "2020-07-17 17:47:16"}, {"id": 19, "types": "drop", "address": "106.124.141.108", "brief": "", "addtime": "2020-07-17 17:47:02"}, {"id": 18, "types": "drop", "address": "139.215.217.181", "brief": "", "addtime": "2020-07-17 17:44:14"}, {"id": 17, "types": "drop", "address": "61.177.172.102", "brief": "", "addtime": "2020-07-17 17:44:01"}, {"id": 16, "types": "drop", "address": "109.244.101.169", "brief": "", "addtime": "2020-07-17 17:43:46"}, {"id": 15, "types": "drop", "address": "182.252.133.70", "brief": "", "addtime": "2020-07-17 17:43:33"}, {"id": 14, "types": "drop", "address": "222.186.15.62", "brief": "", "addtime": "2020-07-17 17:43:18"}, {"id": 13, "types": "drop", "address": "144.172.79.5", "brief": "", "addtime": "2020-07-17 17:43:04"}, {"id": 12, "types": "drop", "address": "222.186.30.35", "brief": "", "addtime": "2020-07-17 17:42:49"}, {"id": 11, "types": "drop", "address": "222.186.31.127", "brief": "", "addtime": "2020-07-17 17:38:46"}, {"id": 10, "types": "drop", "address": "222.186.180.130", "brief": "", "addtime": "2020-07-17 17:38:31"}, {"id": 9, "types": "drop", "address": "186.215.235.9", "brief": "", "addtime": "2020-07-17 17:38:18"}, {"id": 8, "types": "drop", "address": "152.136.141.254", "brief": "", "addtime": "2020-07-17 17:38:03"}, {"id": 7, "types": "drop", "address": "14.142.143.138", "brief": "", "addtime": "2020-07-17 17:37:48"}, {"id": 6, "types": "drop", "address": "112.35.62.225", "brief": "", "addtime": "2020-07-17 17:37:33"}, {"id": 5, "types": "drop", "address": "111.229.78.120", "brief": "", "addtime": "2020-07-17 17:37:18"}, {"id": 4, "types": "drop", "address": "106.12.215.244", "brief": "", "addtime": "2020-07-17 17:36:57"}, {"id": 3, "types": "drop", "address": "23.129.64.0/24", "brief": "hacking", "addtime": "2020-07-11 11:42:22"}, {"id": 2, "types": "drop", "address": "89.248.168.0-89.248.168.255", "brief": "Hacking", "addtime": "2020-07-10 12:50:58"}, {"id": 1, "types": "drop", "address": "212.70.149.0-212.70.149.255", "brief": "212.70.149.0-212.70.149.255", "addtime": "2020-07-09 18:06:25"}]

So for first aid we prepared and exported our firewall rule, which everyone can easily import via the sys firewall

Copy content as and save as ip.json
and import

gacott

CQT This just fixes one issue though, on the server side, from a provider side (OVH) these are still coming at the IP. We need to find the source more so then block the bad guys.

klaus

CQT You can't run a regex to get only the ip's so i lost 10 seconds to do that for you.

106.13.82.54
114.67.113.78
49.235.141.203
203.195.235.135
107.170.104.125
1.204.116.48
159.65.158.30
218.94.156.130
205.185.123.139
121.204.185.106
37.49.224.65
207.244.247.251
51.75.171.171
180.250.248.169
205.185.115.40
154.204.27.249
84.124.204.154
106.124.135.232
49.234.122.94
144.172.73.40
222.186.15.158
128.199.100.254
207.244.247.192
122.51.66.219
114.67.102.106
49.234.83.240
223.167.13.128
119.45.114.87
120.201.125.204
150.129.67.50
144.172.79.8
45.162.216.10
106.75.13.192
222.186.30.218
222.186.52.39
219.250.188.165
168.197.31.14
144.172.73.41
118.89.69.159
82.118.236.186
112.35.57.139
50.70.229.239
85.209.0.103
37.49.224.39
218.92.0.216
58.246.94.230
144.172.79.7
220.78.28.68
124.30.44.214
51.178.55.92
222.186.30.167
186.147.129.110
117.50.8.61
181.30.99.114
222.186.31.166
115.78.4.219
218.255.86.106
222.186.15.115
222.186.42.137
218.92.0.223
216.83.45.162
218.92.0.221
111.229.176.206
222.186.30.76
218.92.0.219
222.186.42.155
222.186.30.112
94.172.225.26
218.92.0.215
93.146.233.226
193.70.12.219
112.17.184.171
222.186.31.83
222.186.42.136
218.92.0.220
36.111.171.108
119.18.194.168
222.186.190.14
222.186.42.7
222.186.180.142
109.115.187.31
222.186.30.57
106.124.141.108
139.215.217.181
61.177.172.102
109.244.101.169
182.252.133.70
222.186.15.62
144.172.79.5
222.186.30.35
222.186.31.127
222.186.180.130
186.215.235.9
152.136.141.254
14.142.143.138
112.35.62.225
111.229.78.120
106.12.215.244
23.129.64.0
89.248.168.0
89.248.168.255
212.70.149.0
212.70.149.255
212.70.149.0
212.70.149.255

And i make enough time to upload a list with the ip's tested.

https://we.tl/t-iTQ8A105T8

How are this ip's from BT panel when are random countries? And mostly are clean ip's not even fucking VPN's.

If someone would want to steal data will do it on long run and over vpn's you know is smarter that way.

gacott

aaPanel_Jose Hey man,

Not the default panel port, ssh port is still standard but ssh pass is very strong.

gacott

TheWormsUnited I have had all of these IPs for years, probably 5 years at this point now, we have around 500 of them. These same IPs were running a different panel, no issues. So we have some issues with the panel here. Hopefully the next update will solve these.

gacott

CQT Yep, we are seeing many of those same IPs. So, more proof it's panel issues. So good we are all working on this together. :-)

CQT

I / We and my employees are in the process of working something out, but it still takes a little time.

As we can see, the firewall and geoip must still be worked on, before aapanel is installed, a proxy must be set up to run the installation. so the ips can no longer be stretched.

CQT

Furthermore, not all countries blockages are accepted by the sys-firewall, there are some problems that have to be fixed beforehand.

@aaPanel_Jose:

Suggestion! Connect the sys firewall and geoip under one tab. Write Config in such a way that both get the DB from one source (folder) and can access it at the same time. Furthermore, the IP and the entire IP range are queried, which can then be blocked using a button, but which the user can decide for himself whether only the individual IP (Geoip is blocked or the entire network of the IP operator). Then integrate the NGINX firewall into the whole. Because on the one hand it is very confusing, and I also think that everything does not work together so harmoniously.

A good approach can be found here: https://gist.github.com/Pandry/21fc0e30abbfd0579ec69c491b99a446

as I said, just an approach!

In addition, the purchased DB from https://www.ipdeny.com/ are outdated and have not been maintained since 2014.

aaPanel_Jose

CQT
I checked the installation script, it just visits a url on aapanel, then aapanel gets the client ip and records it

I tried to enable HTTPS for the requested URL. Can you help me see if there are any attacks after normal installation?

In addition, you only need to allow server access, *.aapanel.com *.bt.cn, all functions of the panel can work

aaP_admin64

CQT

Ip DB from https://www.ipdeny.com/ are not outdated and updated on Sat Dec 4 12:05:34 UTC 2021

How may I import to the list or to Centos 7 Iptables those files lists?

https://www.ipdeny.com/ipblocks/data/countries/all-zones.tar.gz
and https://www.ipdeny.com/ipv6/ipaddresses/blocks/ipv6-all-zones.tar.gz

aaP_admin64

CQT Suggestion! Connect the sys firewall and geoip under one tab. Write Config in such a way that both get the DB from one source (folder) and can access it at the same time. Furthermore, the IP and the entire IP range are queried, which can then be blocked using a button, but which the user can decide for himself whether only the individual IP (Geoip is blocked or the entire network of the IP operator). Then integrate the NGINX firewall into the whole. Because on the one hand it is very confusing, and I also think that everything does not work together so harmoniously.

Which is the full procedure to integrate them all?

Thank you very much

gacott

aaPanel_Jose What are we still getting from *.bt.cn? There is no way to move that stuff off of them and onto somewhere else?

CQT

aaPanel_Jose hello two minutes after the installation the attacks started, not with the ips from node.json, but from the same network operator. We left out the proxy and firewall to see if anything changes and nothing changes. So we can assume that the download requests at the node will be used to track and record the IPS. you have to make sure that the node from bt.cn can no longer be used, we are already trying to load the stuff from the node, but are currently facing problems with it, we had to host the whole thing ourselves, so one clean installation would be possible! So everything that is necessary from the node must be cleaned on another server and first. otherwise aaPanel cannot become what you / your want to achieve. It would also be an absolute risk since all server clients would be contaminated by customers.

aaPanel_Jose

gacott
The domain name of our software download node is download.bt.cn, and there are other nodes in

/www/server/panel/data/node.json

CQT

aaPanel_Jose the api to the node is a problem, as long as you cannot pull the download without the api, you are dependent on the node and as long as the ips can be tracked.

the user who creates here via the db: INSERT INTO users (id, username,password, login_ip,login_time, phone,email) VALUES
(1, 'admin', '21232f297a57a5a743894a0e4a801fc3', '192.168.0.10', '2016-12-10 15:12:56', 0, '287962566@qq.com');

Many of the attacks come from the same, namely from Guangdong Communication Co.Ltd. ASN 9808

All attacks are conducted via our own proxy servers or others, but ultimately from the regions of BT.CN and Shenzhen Tencent Computer Systems Company Limited ASN 45090

backlinks like libList.conf :: "help": "http://www.bt.cn/bbs",
it is very helpful to prepare such attacks, because they alone provide enough information about which ip the panel is installed on.

gacott

CQT Great info, this is what I was getting at and thought something like this was going on. IMO, if we (as a community) want to see this become a successful panel, we need to disengage this from bt. Also, yeah I think this very well may be how they are getting in.

CQT the user who creates here via the db: INSERT INTO users (id, username,password, login_ip,login_time, phone,email) VALUES
(1, 'admin', '21232f297a57a5a743894a0e4a801fc3', '192.168.0.10', '2016-12-10 15:12:56', 0, '[287962566@qq.com](mailto:287962566@qq.com)');

aapanel_user

gacott you can fork the panel and do whatever you want. What's the problem?

waikey

still waiting for response! I have use aapanel on several VPS and everything is OK! Aso I use the Chinese Version BT Panel. ..

Baidu is NO1 SE company in China so I think someone is using their IP as bridge to attacke

or maybe it's Baidu's spider ? try to ban the Baidu's spider in the robots.txt

gacott

waikey It would be a SUPER aggressive spider. Blocking in robots.txt will do nothing, these are attacks on ports.

CQT

waikey We don't want to come to China and data protection now, it doesn't matter which company comes from. China has never been a country that values data protection. That's why I don't put everyone under general suspicion, but I trust state-owned companies like my ex-wife. Not directly related to aaPanel, but to NO1 SE. Everyone knows that everything and that is spied on and I also know a little bit about the politics of China. According to this sentence, I would be a dead man in China.

TheWormsUnited

CQT you clearly dont know what you are talking about. I lived and visit China several times per year so your affirmations are not accurate at all. I am sorry thats not correct.

China offers several business and services, we cannot state and talk about politics on a webhosting control panel forum, makes no sense at all. Let's keep it to the topic.

gacott

aapanel_user WTF are you talking about? I'm trying to help make a better panel, HERE! Why are you talking about forking it? Is there something wrong about contributing to this project? Do I have to fork and start my own to contribute?

CQT

TheWormsUnited you're right politics has no business here. I will hold back in this regard in the future.
We all want the same thing, that aaPanel gets better and spreads more

« Previous Page Next Page »