PayPal (7) couldn't connect to host

Forward that to your hosting company, since it's indication that there has been a problem with the server. It's too bad they wouldn't contact AT&T directly.

DrByte:

It's too bad they wouldn't contact AT&T directly.

Unforgivable is what I call it. :shocking:

Cheers
Rod

Hello OK Crazy Domain responded back with this ....

DDOS attak has nothing to do with our server. It is something included or injected in your script. PLease review your codes.
There might be a script that activated DDOS to attack
You are using a dedicated ip address since you have SSL so this means it is not comming from the server but solely to your script used.

So do you know some one who can go through my files and clean them as they say its me! Regards Connie

Party Craze:

DDOS attak has nothing to do with our server. It is something included or injected in your script. PLease review your codes.
There might be a script that activated DDOS to attack
You are using a dedicated ip address since you have SSL so this means it is not comming from the server but solely to your script used.
Oy. That's a pretty tenuous leap to wash their hands of it so broadly. Sheesh.

If it was my site, this is what I'd do: http://www.zen-cart.com/wiki/index.php/Recovering_From_Hacks ... since that process covers all the same areas that need inspection if there were something rogue on your site.

But even though your hosting company has denied any potential culpability in this problem, they still have a very large part to play. If they refuse to participate in solving the problem, find another company who actually cares. Seriously.

Party Craze:

So do you know some one who can go through my files and clean them as they say its me! Regards Connie

Straight from the movies eh?

"we've just traced the call... its coming from inside the house!" (When a Stranger Calls. 2006)

No point in repeating DrByte's sage advice, but before jumping to the conclusion that your store has been hacked, you should first consider other possible causes of compromise. For example, WordPress is once again being exploited and attacked. If you have WP installed on your site, even if not used, it could be used as a participant in the DDOS.
Using this as an example, the cleanup is easy, uninstall the unused WP software and delete any files it leaves behind.

As for Crazy Domains. Please advise them that your network administrator has requested access to the Router and/or its real time log files to aid diagnosis and ensure the problem is rectified.

When they deny this request (I assure you, they will), request more info about the exploit. What has it been called, what port numbers does it use, how does it spread (which isn't the same thing as what it does).

By this time, thing's will have been escalated once again to a more qualified technician who'll probably do what they can to fix the problem for you. It'll be easier than answering the 'difficult' questions. <grin>

Cheers
Rod (Managing Director: BistardsRus Pty Ltd)

PS. By following my tips you will slowly progress into a becoming a grumpy old wo/man. Personally I don't have an issue with that. Apparently others find it objectionable, but who cares what todays' youngsters think, eh? :)

Grumpy Old Woman' Are you insinuating i am old? LOL :lookaroun

OK here goes Crazy Domains would not help me so i contacted AT&T again and a Manger from that company took over for me and dealt with Crazy Domains he said it is my server and he will ensure they fix it. AT&T had blocked my IP Address because Crazy Domains DDOS problem. Soooo Crazy Domains have now given me a new IP Address number once the SSL is fixed i will try and see if the PayPal works.
Its been fun talking with you guys but this will all hopefully come to an end shortly' :yes:

Thanks Rod:
TICK > Please advise them that your network administrator has requested access to the Router and/or its real time log files to aid diagnosis and ensure the problem is rectified.

TICK > I have followed your advise and the Docs to a T' Progress slow but making head way...

An alternate IP address is a good temporary bandage. Actually I wish I'd suggested that initially, because it could have at least shortened the amount of downtime. It wouldn't have resolved the original real problem, but it would have kept sales going through. Fingers crossed that it works.

I still recommend a thorough site inspection, if only for peace of mind.

DrByte:

An alternate IP address is a good temporary bandage. Actually I wish I'd suggested that initially, because it could have at least shortened the amount of downtime..

Hindsight is a wonderful thing though.

Being IP blocked by servers that have nothing to do with the end point transaction must surely break protocol somewhere though? How did this come to be?

Cheers
Rod

RodG:

Hindsight is a wonderful thing though.

Being IP blocked by servers that have nothing to do with the end point transaction must surely break protocol somewhere though? How did this come to be?

Cheers
Rod

Hello i found out about the block because of the Dr suggesting i contact AT&T direct so i did and this is what they sent back to me...

203.170.85.121 was identified as participating in a DDoS attack. To prevent damage to the AT&T infrastructure or its customers, AT&T has blocked the traffic of the referenced IP address through its network. If this is a shared IP address used for virtual hosting, all virtual hosts may be affected.

sensitive information removed by moderator

Please treat the information in this email as sensitive and distribute only to those parties that have a need to know.

Send e-mail notification by email, when it has been confirmed that the server is clean. AT&T will then remove the block that is in place.

If the IP address is identified again, AT&T will reinstate the block.

I got up this morning and had this message from Crazy Domains:

Crazy Domains said: DDOS attak has nothing to do with our server. It is something included or injected in your script. Please review your codes. There might be a script that activated DDOS to attack. You are using a dedicated ip address since you have SSL so this means it is not coming from the server but solely to your script used.

** I then emailed AT&T again this morning and this is the response back**

Response back:

Connie,

Your hosting company needs to clean the server. If they won’t help you can you please forward AT&T their e-mail address?
We can then send the response directly to them.

Robert W. Terry

Sr. Business Security Mgr.

AT&T - IP Security & Control Plane Services

I then gave him the details for Crazy Domains and Crazy Domains then emailed me back not long after the request with this response:

Hello,

Thank you for contacting Customer Support.

Sorry for the delayed.

We have changed the IP and it take about 2 to 4hrs for the site to become live.
The new IP address is (Number of the IP) given

Please feel free to contact us if you have further queries.

Regards,
May
Online Support Team

Crazy Domains
Customer Support

So now because they did not adjust the SSL to match that is not currently working.

I will change servers in the next few days and hope this will resolve all issues and i do hope my files are not corrupt.

Sorry this is starting to become a book....

DrByte:

An alternate IP address is a good temporary bandage. Actually I wish I'd suggested that initially, because it could have at least shortened the amount of downtime. It wouldn't have resolved the original real problem, but it would have kept sales going through. Fingers crossed that it works.

I still recommend a thorough site inspection, if only for peace of mind.

That's OK if this is a bandage fix i hope it will become permanent if i change host! Fingers Crossed. For now Pay Pal is now working! Tap Tap!!

Party Craze:

That's OK if this is a bandage fix

i hope it will become permanent if i change host! Fingers Crossed. For now Pay Pal is now working! Tap Tap!!

Before you change hosts, ensure you have a copy of your current SSL certificate files. These 'belong' to the owner of the host.domain.name and can be transferred along with your website.

The IP address (which should be of no concern to most users) can be changed at any time (within reasonable time parameters), and out of necessity will change any time you change hosts.

There can only be one SSL per IPaddress, so consider the possible additional cost for this when shopping around.

Cheers
Rod

Please treat the information in this email as sensitive and distribute only to those parties that have a need to know.

Your judgement that you feel we have a need to know is appreciated, but at the same time please be careful about how/when and where you do this in the future. Sometimes this type of information could be sensitive. Especially time sensitive.

In this case, it's a matter of, 'move along. Nothing (new) to see here.

One of the many references to be found on google goes back almost a year......

Thu Aug 16, 2012
http://forum.joomla.org/viewtopic.php?t=737503

Cheers
Rod

PS. I believe with the current round of events, it is a new vulnerability being exploited, but leaving behind the same payload as this old one).

RodG:

Your judgement that you feel we have a need to know is appreciated, but at the same time please be careful about how/when and where you do this in the future. Sometimes this type of information could be sensitive. Especially time sensitive.

In this case, it's a matter of, 'move along. Nothing (new) to see here.

One of the many references to be found on google goes back almost a year......

Thu Aug 16, 2012
http://forum.joomla.org/viewtopic.php?t=737503

Cheers
Rod

PS. I believe with the current round of events, it is a new vulnerability being exploited, but leaving behind the same payload as this old one).

Hello not sure how this relates to me? > Thank you

One of the many references to be found on google goes back almost a year......

Thu Aug 16, 2012
http://forum.joomla.org/viewtopic.php?t=737503

Party Craze:

Hello i have switched everything off for payments and only use Bank Deposit at the moment no orders since last week" I contacted AT&T my self after what you had written this is what i got back. So i gather my Server needs to fix this? Or me?

I do apologize sorry for that!

Party Craze:

Hello not sure how this relates to me? > Thank you

One of the many references to be found on google goes back almost a year......

Thu Aug 16, 2012
http://forum.joomla.org/viewtopic.php?t=737503

Thank you for your help moving along!

RodG:

AT&T:

Please treat the information in this email as sensitive and distribute only to those parties that have a need to know.

Your judgement that you feel we have a need to know is appreciated, but at the same time please be careful about how/when and where you do this in the future. Sometimes this type of information could be sensitive. Especially time sensitive.

Party Craze:

Hello not sure how this relates to me?

He was referring to the fact that you directly copied sensitive information from the AT&T email and posted it here twice, despite the email specifically requesting it be treated as sensitive and not distributed broadly.

(Our moderator has since gone and removed that content)

I've just started having this issue too and sadly I'm with Crazy Domains too. 2 years has been working fine now the past week has stopped.

Not looking forward to the fix with Crazy Domains after reading this thread.

http://www.zen-cart.com/showthread.php?65680-PayPal-Communications-Response-Testing-Tools