Krydos

It looks like /home/bscripts/public_html/storm8/scriptresources/lootglitcher.php has been causing most of your load. Taking a quick peek at it all I see is curl after curl after curl call. Some bot to play a game for you or something? Anyways, curl causes a lot of load. Perhaps moving to Johnny would help since that server has a higher threshold for suspending accounts for high load. Stevie is pretty sensitive to suspending accounts like yours to prevent downtime for all the other users. This is part of the reason we can maintain 99% uptime on Stevie while Johnny is considerably lower than that. Out of curiosity I checked the TOS of Storm8 which states: I'm going to leave your account suspended until you can explain to us how your scripts don't violate their TOS.

The account was created using the email address umunol@yahoo.com

Dedicated IP granted.

cpu mem 2014-02-20 2 6 2014-02-19 1 3 2014-02-18 1 1 2014-02-17 2 3 2014-02-16 1 6 2014-02-15 9 5 2014-02-14 26 8

Please post the following information: Your cPanel username Your main domain The server that you are on

It looks like this one sort of fell through the cracks. Sorry for the long delay in getting a response. I was able to install frontpage extensions on my Johnny account successfully without any errors. Perhaps it was a temporary error? Let us know if you're still having any issues.

You already have a dedicated IP anyways http://www.helionet.org/index/topic/20144-cannot-create-johnny-ssl-account/page__view__findpost__p__106509

The record has been updated. Let us know if it still isn't working.

Well, here's the two SRV records I added: DOMAIN TTL PRIORITY WEIGHT PORT HOST _sip._tcp 14400 IN SRV 100 1 443 sipdir.online.lync.com. _sipfederationtls._tcp 14400 IN SRV 100 1 5061 sipfed.online.lync.com. The fields I need are domain, ttl, priority, weight, port, and host. There is no service, protocol, or target. Both records look very similar to many other SRV records on our DNS servers. Perhaps if you show me the instructions that you received from lync.com it will make this easier? Also, I know TTL doesn't match what you said, but the smaller that number is the more load it puts on our servers. Unless you're changing these SRV records all the time it probably doesn't need to be so small.

I can't find a payment with that transaction ID, or any payments sent from the email address associated with the hosting account web65 or the validated forum account that you posted from. Can you verify the transaction ID or let us know what email address you sent the payment from?

I couldn't find /home/softlab/REWeb.war so I deployed /home/softlab/public_html/REWeb.war instead. http://softlab.heliohost.org/REWeb

Most of your load comes from /home1/gargsms/public_html/cgi-bin/nph-proxy.cgi Without even viewing the code I would guess that, as the name suggests, this is a proxy. Web proxies are always going to cause a lot of load. That's just how they work. You have a couple options: You can try to only use your proxy when the server load is low. We only suspend high load accounts when the overall load is high. There is no set maximum load that each account can create, but if the server starts to be overloaded the highest load accounts are suspended first to prevent slow page loads or crashes for all the other thousands of innocent websites hosted on your server. You could also move your account to Johnny. Part of the reason the uptime on Johnny generally hovers around 90% and the uptime on Stevie is 99.8% is because we suspend accounts like yours that cause a lot of load before they can cause downtime on Stevie. Johnny doesn't have nearly as touchy of a threshold for suspension so you would most likely be able to run your proxy as much as you wanted on Johnny with a much lower chance of being suspended. Obviously if you delete the proxy then you'll most likely not be suspended again. The choice is yours.

The format you posted isn't quite what I've seen before, but I think I got it translated into a form the DNS servers can recognize. Let us know if it isn't working.

Your account has been unsuspended. Sorry for the inconvenience, but we have to take these reports very seriously. Since we are a free hosting service we tend to unfortunately attract a lot of the undesirables on the internet. When Hurricane Electric sends us a take down request we have to comply quickly otherwise they will (and have) null routed our IP addresses instantly taking down literally tens of thousands of innocent websites. The malware scanner that we use (clamav) shows your account as clean. If you take a look at virustotal: https://www.virustotal.com/en/file/f3be18c5019b692b1540fef32899101928a4656d3e26b8ca97fb93ab2696e903/analysis/1411904511/ you can see that 17/55 scanners flag your file as malicious. Furthermore since the email from Hurricane Electric specifically stated "HackTool.Win32.mIRC.atR" you can know that it was most likely Baidu that caught you so I would recommend contacting them, and maybe the other 16 AV software, to get your file delisted. Wolstech's advice is good. If you host the file elsewhere it will only be a single download that will break rather than your entire website getting taken down should something like this happen again.

It's working fine for me. I see Index of / User65/ cgi-bin/ user65/ directories when I go to that domain. If this happens it is actually a bug. 95% of the time it should take less than 24 hours for accounts on both Stevie and Johnny to come out of queue. Since the account creation is based on load it might in some cases take up to 48 hours, but if it is taking longer than that please let me know because something is quite broken.

Ok, I tested this out for you. Here is my test site: http://krydos.tk/country/ To create this site I first went to http://stevie.heliohost.org:2082/frontend/x3/module_installers/index.html?lang=php-pear to install the Net_GeoIP package. Once it is installed you will be able to find the files at /home1/thio175/php/Net/ I then copied them to the public_html/country folder to simplify my code, but I'm sure they would work fine where they were. Then I created my index.php file with the following contents: <?php require_once "Net/GeoIP.php"; $geoip = Net_GeoIP::getInstance("GeoIP.dat"); echo $geoip->lookupCountryName($_SERVER['REMOTE_ADDR']); The GeoIP.dat file I got for free from maxmind's website which is linked from the documentation of Net_GeoIP, but you can download it from my website if it's easier for you. http://krydos.tk/country/GeoIP.dat and just put that file somewhere on your account where your php script can access it.

It looks like Net_GeoIP http://pear.php.net/manual/en/package.networking.net-geoip.php does the same thing and is already installed on both servers. Why not just use that?

Ok, it's working again. Let me know if you're still having trouble sending emails to yahoo from Johnny.

Just post here, or create a new topic if you're curious how your load stands after you've made some changes.

Here is your load and memory usage for the past week as a rank of all accounts on your server. The smaller the number the higher the load, and the more likely you are to get suspended. * means negligible cpu or memory usage. date cpu mem 2015-02-03 2 8 (suspended for about 40% of the day) 2015-02-02 6 10 2015-02-01 10 19 2015-01-31 * * 2015-01-30 * * 2015-01-29 * * 2015-01-28 * 35 According to the logs /home/epicaleb/public_html/hostedapp/SocialNotify/feedFetcher.php might be causing most of your load.

Thanks for noticing this and letting me know about it. Whenever I write a script that has as much power as suspending an account automatically I test it very thoroughly. This cron script I actually started writing in March 2013. After almost a year of using it manually, and verifying the results to be legitimate I automated it on January 18th 2014. Still I continued to manually check the accounts it was suspending from time to time, and it has never once bugged out or done anything unexpected. Until yesterday. My profuse apologies to the 51 accounts that were suspended for overuse of cron between 4:09 am, and 4:28 am. I suspect at least a few of them did actually exceed the limit of two, but just to be safe I have already unsuspended them all. I have already fixed the automatic cron suspension script, and this shouldn't happen again. Obviously after almost two years of thorough testing it was a bit of a fluke for this to happen.

I don't see an account with that username or that domain on any of the servers. When you create a hosting account on Heliohost you should get two emails. The first just lets you know that your account has been added to the creation queue, and then the second lets you know the outcome of the creation attempt. If there is a problem creating your account the second email will contain an error message. Did you get either email? If so what is the error, or does the second email say the account was created successfully? Either way I would recommend creating your account again by visiting http://www.heliohost.org/home/signup

Does it work now?

/tmp cleaned and the abusive account suspended.

Here is the report we received regarding your account: We have received a complaint about your account. Please investigate and fix within 24 hours. Hurricane Electric Abuse Department support@he.net From scomp@aol.net Sat Dec 13 14:39:01 2014 Return-Path: <scomp@aol.net> X-Original-To: report@abuse.he.net Delivered-To: report@abuse.he.net Received: from smr-m2.mx.aol.com (smr-m2.mx.aol.com [64.12.232.218]) by abuse.he.net (Postfix) with ESMTPS id 1F1EB540302 for <report@abuse.he.net>; Sat, 13 Dec 2014 14:39:01 -0800 (PST) Received: from scmp-m004.mail.aol.com (scmp-m004.mail.aol.com [172.29.110.247]) by smr-m2.mx.aol.com (AOL Mail Bouncer) with ESMTP id 7EE97380006C8 for <report@abuse.he.net>; Sat, 13 Dec 2014 17:39:00 -0500 (EST) Received: from scomp@aol.net by scmp-m004.mail.aol.com; Sat, 13 Dec 2014 17:38:55 EST To: report@abuse.he.net From: scomp@aol.net Date: Sat, 13 Dec 2014 17:38:55 EST Subject: Email Feedback Report for IP 65.19.143.2 MIME-Version: 1.0 Content-Type: multipart/report; report-type=feedback-report; boundary="boundary-1138-29572-2659438-25559" X-AOL-INRLY: stevie.heliohost.org [65.19.143.2] scmp-m004 X-Loop: scomp --boundary-1138-29572-2659438-25559 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit This is an email abuse report for an email message with the message-id of E1XzvHW-0003hq-TD@stevie.heliohost.org received from IP address 65.19.143.2 on Sat, 13 Dec 2014 17:35:11 -0500 (EST) For information, please review the top portion of the following page: http://postmaster.aol.com/Postmaster.FeedbackLoop.php For information about AOL E-mail guidelines, please see http://postmaster.aol.com/Postmaster.Guidelines.php If you would like to cancel or change the configuration for your FBL please use the tool located at: http://postmaster.aol.com/SupportRequest.FBL.php --boundary-1138-29572-2659438-25559 Content-Disposition: inline Content-Type: message/feedback-report Feedback-Type: abuse User-Agent: AOL SComp Version: 0.1 Received-Date: Sat, 13 Dec 2014 17:35:11 -0500 (EST) Source-IP: 65.19.143.2 Reported-Domain: stevie.heliohost.org Redacted-Address: redacted Redacted-Address: redacted@ --boundary-1138-29572-2659438-25559 Content-Type: message/rfc822 Content-Disposition: inline Return-Path: <nick@wacc.heliohost.org> Received: from stevie.heliohost.org (stevie.heliohost.org [65.19.143.2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mtaig-mad06.mx.aol.com (Internet Inbound) with ESMTPS id 26984700000A6 for <redacted@aol.com>; Sat, 13 Dec 2014 17:35:11 -0500 (EST) Received: from redacted by stevie.heliohost.org with local (Exim 4.80) (envelope-from <nick@wacc.heliohost.org>) id 1XzvHW-0003hq-TD for redacted@aol.com; Sat, 13 Dec 2014 14:35:01 -0800 To: redacted@aol.com Subject: deleteMe has created an account at wacc MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed; delsp=yes Content-Transfer-Encoding: 8Bit X-Mailer: Drupal From: nick@wacc.heliohost.org Message-Id: <E1XzvHW-0003hq-TD@stevie.heliohost.org> Date: Sat, 13 Dec 2014 14:34:57 -0800 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - stevie.heliohost.org X-AntiAbuse: Original Domain - aol.com X-AntiAbuse: Originator/Caller UID/GID - [40256 32003] / [47 12] X-AntiAbuse: Sender Address Domain - wacc.heliohost.org X-Get-Message-Sender-Via: stevie.heliohost.org: authenticated_id: redacted/from_h X-Source: /usr/bin/php X-Source-Args: /usr/bin/php /home/redacted/public_html/index.php X-Source-Dir: wacc.heliohost.org:/public_html x-aol-global-disposition: G Authentication-Results: mx.aol.com; spf=none (aol.com: the domain wacc.heliohost.org appears to have no SPF Record.) smtp.mailfrom=wacc.heliohost.org; x-aol-sid: 3039ac1addc6548cbf1e1ede X-AOL-IP: 65.19.143.2 X-AOL-SPF: domain : wacc.heliohost.org SPF : none You need to activate her! Follow this link, http://wacc.heliohost.org/admin/people , and unblock. --boundary-1138-29572-2659438-25559-- I can understand why it got reported as spam. "activate her" sounds like a phrase that would be used in a spam email. As a word of warning, I would be really careful sending emails to anyone that actually still uses @aol.com address because either AOL is really crazy about spam or their users report everything they receive as spam. Either way we get a lot of reports from them. Your account has been unsuspended. Please be more careful to not send emails that could be confused for spam.