blocked website for easyfolderlisting pro

[matrix]

hi michael
As mentioned by you, I opened a new thread for the problem here.
about a year ago, a website was blocked by the hoster, because too much traffic occurred. it turned out that easyfolderlisting caused the traffic. I then had to uninstall easyfolderlisting, because the problem synonymous after various backups has occurred einspielen.
a few days ago another website was blocked for the same reason.

the message from hoster was:

Warum wurde der Bereich gesperrt?
Der Bereich wurde gesperrt, da der Inhalt Ihrer Website aufgrund von übermässigem Ressourcenverbrauch gegen unsere Allgemeinen Geschäftsbedingungen (AGB) verstösst. Nachfolgend finden Sie einen Auszug aus der Logdatei oder weitere Informationen zur Ursache der Problematik:
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
32505 web64 20 0 177m 34m 20m R 44 0.1 10:46.68 php
4691 web64 20 0 177m 34m 20m R 42 0.1 6:58.30 php
31855 web64 20 0 177m 34m 20m R 42 0.1 11:55.03 php
32252 web64 20 0 177m 34m 20m R 42 0.1 11:25.46 php
598 web64 20 0 177m 34m 20m R 41 0.1 10:11.88 php
12324 web64 20 0 177m 34m 20m R 41 0.1 141:48.04 php
32218 web64 20 0 177m 34m 20m R 41 0.1 11:33.53 php
32281 web64 20 0 177m 34m 20m R 41 0.1 11:10.27 php
1003 web64 20 0 177m 34m 20m R 40 0.1 9:38.19 php
7251 web64 20 0 177m 34m 20m R 40 0.1 4:15.02 php
31341 web64 20 0 177m 34m 20m R 40 0.1 92:22.10 php
32352 web64 20 0 177m 34m 20m R 40 0.1 11:02.59 php
32550 web64 20 0 177m 34m 20m R 40 0.1 10:43.91! php
32736 web64 20 0 177m 34m 20m R 40 0.1 10:28.68 php
1019 web64 20 0 177m 34m 20m R 39 0.1 9:35.93 php
7918 web64 20 0 177m 34m 20m R 39 0.1 154:40.68 php
684 web64 20 0 177m 34m 20m R 38 0.1 10:01.29 php
9552 web64 20 0 177m 34m 20m R 38 0.1 1:47.57 php
10151 web64 20 0 177m 34m 20m R 37 0.1 148:10.86 php
32410 web64 20 0 177m 34m 20m R 37 0.1 10:53.90 php

+——–+———+———–+————–+———+——+——-+——————+
| Id | User | Host | db | Command | Time | State | Info |
+——–+———+———–+————–+———+——+——-+——————+
| 500337 | schupfi | localhost | schu_gde_01 | Sleep | 1719 | | |
| 500406 | schupfi | localhost | schu_gde_01 | Sleep | 1698 | | |
| 500415 | schupfi | loca! lhost | schu_gde_01 | Sleep | 1689 | | ! |
| 500420 | schupfi | localhost | schu_gde_01 | Sleep | 1675 | | |
| 500428 | schupfi | localhost | schu_gde_01 | Sleep | 1664 | | |
| 500440 | schupfi | localhost | schu_gde_01 | Sleep | 1654 | | |
| 500444 | schupfi | localhost | schu_gde_01 | Sleep | 1645 | | |
| 500447 | schupfi | localhost | schu_gde_01 | Sleep | 1638 | | |
| 500516 | schupfi | localhost | schu_gde_01 | Sleep | 1608 | | |
| 500596 | schupfi | localhost | schu_gde_01 | Sleep | 1579 | | |

From this message you could not find anything concrete, which pointed to easyfolderlisting.

I then phoned the hoster and it came out that from america from different ip addresses a “get” request leads to the high traffic.

I have now asked the hoster, if he maybe has more detailed information.

I suspect that this is a call from easyfolderlisting pro. this call logically leads to easyfolderlisting pro looking for files in a defined folder and then displaying them. here I suspect that there is a loop and easyfolderlisting pro triggers this search over and over again due to the unusual request (the unusual call). but that’s just a guess.

the message from the host indicates that traffic is being generated in the joomla database.

it will show, if this problem under version 3.3 then shows again.
but maybe you can easily start with this information and what to check if there easyfolderlisting pro has a “gap”.

greetings, marcel

[matrix]

here are other data from the acces log:
157.55.39.235 – – [30/Apr/2019:06:56:23 +0200] “GET /cms/component/easyfolderlistingpro/?view=download&format=raw&data=eNpNj8GOwjAMRP_F94qmrAprrnvkH1C6nZZISaiSsCAQ_75O0woucWYyz3Y0K8XPyC3TcLE9Ah1cIjc7JuP0iLgZ4WB8j43Np–sTilHhKJrRChQnC2men0ar4jp3VD6nU6zl9W-oF47ZFkz5dIW1_R0MFxcFyjATjqdP1LCDsZiZRvRx_dm1VZVP3jAdQhVU6t9zmyZcE_LbeqHZSHcXCcTENdpSgZIB_17dvCS7mb3W4iAP4Nb-cgXk794Gf36B0qnYvg, HTTP/1.1” 200 20 “-” “Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)” http://www.schupfart.ch
207.46.13.210 – – [30/Apr/2019:06:56:55 +0200] “GET /cms/component/easyfolderlistingpro/?view=download&format=raw&data=eNpNj90OwiAMhV_F9N448L-78t53WJjrJgkwAqhLjO9uERe9ofRwvtOiUAh8Rtwh9KPpKEAdUe4RtFUDxdVAlrTraGXy6VqjUsoWpuAWKRQofiSEan4abhTTL5Dzmuaj5e5QUKcs5bZCyGVXVN1BrbEqUCDjVbr-uZjttaGZlVuE82-zpTw2XCcftFnIShyyYY1AU_refNd_t6HJ60BxHiU4nXF1uVpy7G5RsHpkXCLQXdOj_GKD4EbHc19vF0Bh7A,, HTTP/1.1” 200 20 “-” “Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)” http://www.schupfart.ch
207.46.13.118 – – [30/Apr/2019:06:57:23 +0200] “GET /cms/component/easyfolderlistingpro/?view=download&format=raw&data=eNpNj90OgjAMhV_F9N7wowGtV977DmS4AkvGINtQEuO72zEI3qzr2flOO4FZhh-HBUIzaEkWbg7zEkH1oiWXtNSTMpISHU5Ta-F9sDAFkyMbIbdICOn21E7k_B7IeVW1aKG7RNSInkKbXCKEUkRVSbgpTCNkSY_Cd38uZhulaWNzph77Zse8rO5TOzl_yNOsDI4TAs1-vY2yWdeheVSW3DYr43jmxbPrybC7XtQrE5Zeit7xG2cEMxge_P0Bi-diag,, HTTP/1.1” 200 20 “-” “Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)” http://www.schupfart.ch
157.55.39.146 – – [30/Apr/2019:06:58:04 +0200] “GET /cms/component/easyfolderlistingpro/?view=download&format=raw&data=eNpNj9EOgjAMRX_F9N3AUEHLk-_-A5lSYMkYZBtKYvx3OwfBl3W9u-e2kygEvh3mCM2ga7JQOswKBNXLllxc0lJPytSU6HCau5beBwtTMDmyEXI_CSFdn9qJnN8COa-qflrozhE1sqfQpgih5FFVNZQK0whZ0qP03Z-L2UZpWtnshHDbNttneXUdrdK7LBVFMBwQaPbLbaybZRuaR2XJraMEpzMuH11Pht13FKxemLD0VPSKvzhcIpjB8NzPFxWzYeg, HTTP/1.1” 200 20 “-” “Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)” http://www.schupfart.ch

[Author]

Posts