So, what happened?

Is it just me, or was AA down for a good 24 hours?
I am guessing a database crash, only because the "contact us" page isn't working...
However no threads appeared as to why the downtime, so I am wondering

 

For a while I saw an message that they had moved to a new server and was waiting for the dns to take full change.

 

Picture virus

 

Nick just moved to a new server, AFAIK

 

Yep, it was just a server move. Nothing major!

 

Seez you.

If it wasn't for Brandon suggesting I should use another browser I still would not have gotten in.

I keep getting a "Parallels H-Sphere" page from my main computer, any suggestions? I did clear my cache and that did not help.

Sounds like you moved to a vps.

 

Ah, ok, someone was looking to advertise something server related on one of my sites, told him to look here... he mentioned that the advertise link was broken(database error), I thought he was crazy cause I couldn't load the site (well, got closed message)...

 

I'm still getting the "Parallels H-Sphere" page from my main computer when I try to view this site.

I am typing on a spare computer, until I can figure out how to access AA from my main computer I won't be logging in much.

 

Not saying this will help...

run from the command line:
ipconfig /flushdns

(notice space after ipconfig before the /flushdns ....

 

didn't help : (

 

Sorry to hear that, maybe set up a tinyurl with the sites ip addy and use that on the main computer? Get the ip by pinging the site through the command line...

Sent from my HTC EvO 4G

 

I am going straight to the IP address and now it is giving me a different "Parallels H-Sphere" page. It is letting me choose between using phpmyadmin, reading email, and a few other things : D

?

 

I'll keep checking in 2x per day if I remember, from the domain tools.com information it looks like it might be on a busy vps account with 56 sites on it?

No idea why one computer can reach AA, but my main computer cannot. I would assume others are having problems as well.

 

I never did see a "site down" message or anything out of the ordinary.. :ohi:

 

Do you have any ideas why I might not be able to get to AA from my main computer using FF? I've cleared all private data.

?

I just checked and I can get to AA using IE 6.0 on the main computer, but not FF 3.6.3 which was working fine before.

 

I'm checking into this -- however, all seems normal on this end.

 

I'm not sure who you are, but now the IE on my primary computer keeps getting the parallels page. "Error 400 bad request"

I am now typing on the secondary computer. If I dissappear off this forum it will probably because I cannot get to it. If people send PMs, because the message is stripped out, I will not see the PM contents.

 

Can you try now and see if it'll work? I think I found the issue.

 

Works great on my primary computer using both FF & IE! Although since the move the forum is a bit slow to respond.

What was the problem?


(keep in mind we are all trying to learn about these types of things cause it is an admin forum)

 

Are you familiar with mod_security? If so, here's the actual rule that was being triggered:

[Mon Jul 05 11:09:57 2010] [error] [client 75.36.236.60] ModSecurity: Access denied with code 400 (phase 2). Pattern match "%0[ad]" at REQUEST_HEADERS:Cookie. [file "/hsphere/local/config/httpd2/modsecurity-core-rules/modsecurity_crs_40_generic_attacks.conf"] [line "83"] [id "950910"] [msg "HTTP Response Splitting Attack. Matched signature <%0a>"] [severity "ALERT"] [hostname "adminaddict.net"] [uri "/forum/index.php"] [unique_id "TDID1UMWilwAADMGA0kAAAAI"]

and

[Mon Jul 05 08:44:44 2010] [error] [client 93.223.182.80] ModSecurity: Access denied with code 400 (phase 2). Invalid UTF-8 encoding: invalid byte value in character at REQUEST_HEADERS:Cookie. [offset "270"] [file "/hsphere/local/config/httpd2/modsecurity-core-rules/modsecurity_crs_20_protocol_violations.conf"] [line "67"] [id "950801"] [msg "UTF8 Encoding Abuse Attack Attempt"] [severity "WARNING"] [hostname "adminaddict.net"] [uri "/forum/images/vbseo/linkback_url.gif"] [unique_id "TDHhzEMWilwAAEMJpo8AAAAB"]

which came up in the logs a lot (I would suspect the first is what you got nabbed by). So, I excluded both rules from mod_security and issue resolved.

:spin: