Query creates channels, send messages or pokes users

[Webdancer]

That is not query logging, or the log is from the wrong log file.

I'm sorry, but I do not posted the other log beause there was no query log except one which use a query login I created. Thats user "wbb" from my wbb board to have a ts3 overview in my forum.
Edit Virtual Server => More => Logs => all activated incl. ServerQuery + restart of the server.

2017-02-24 09:34:25.803567|INFO    |ServerLibPriv |   |TeamSpeak 3 Server 3.0.13.6 (2016-11-08 08:48:33)
2017-02-24 09:34:25.803643|INFO    |ServerLibPriv |   |SystemInformation: Linux 3.16.0-4-amd64 #1 SMP Debian 3.16.39-1 (2016-12-30) x86_64 Binary: 64bit
2017-02-24 09:34:25.803660|INFO    |ServerLibPriv |   |Using hardware aes
2017-02-24 09:34:25.804044|INFO    |DatabaseQuery |   |dbPlugin name:    SQLite3 plugin, Version 3, (c)TeamSpeak Systems GmbH
2017-02-24 09:34:25.804066|INFO    |DatabaseQuery |   |dbPlugin version: 3.11.1
2017-02-24 09:34:25.804167|INFO    |DatabaseQuery |   |checking database integrity (may take a while)
2017-02-24 09:34:25.968748|INFO    |Accounting    |   |Licensing Information
2017-02-24 09:34:25.968785|INFO    |Accounting    |   |type              : Non-profit
2017-02-24 09:34:25.968802|INFO    |Accounting    |   |starting date     : Sun Oct  9 00:00:00 2016
2017-02-24 09:34:25.968814|INFO    |Accounting    |   |ending date       : Wed Apr 12 00:00:00 2017
2017-02-24 09:34:25.968823|INFO    |Accounting    |   |max virtualservers: 10
2017-02-24 09:34:25.968832|INFO    |Accounting    |   |max slots         : 512
2017-02-24 09:34:26.348078|INFO    |              |   |Puzzle precompute time: 367
2017-02-24 09:34:26.348354|INFO    |FileManager   |   |listening on 0.0.0.0:30033, :::30033
2017-02-24 09:34:26.358092|INFO    |CIDRManager   |   |updated query_ip_whitelist ips: 127.0.0.1/32, xxx.xxx.xxx.xxx/32, xxx.xxx.xxx.xxx/32, 
2017-02-24 09:34:26.358239|INFO    |Query         |   |listening on 0.0.0.0:10011, :::10011
2017-02-24 09:36:53.498736|INFO    |Query         |   |query from 46 xxx.xxx.xxx.xxx:49865 issued: login with account "wbb"(J8D343B9Myit8K+fmdt48WDqb5I=)
2017-02-24 09:37:14.613741|INFO    |Query         |   |query from 46 xxx.xxx.xxx.xxx:49867 issued: login with account "wbb"(J8D343B9Myit8K+fmdt48WDqb5I=)
2017-02-24 09:37:23.914405|INFO    |Query         |   |query from 46 xxx.xxx.xxx.xxx:49868 issued: login with account "wbb"(J8D343B9Myit8K+fmdt48WDqb5I=)
2017-02-24 09:37:38.722961|INFO    |Query         |   |query from 46 xxx.xxx.xxx.xxx:49869 issued: login with account "wbb"(J8D343B9Myit8K+fmdt48WDqb5I=)
2017-02-24 09:37:45.889727|INFO    |Query         |   |query from 46 xxx.xxx.xxx.xxx:49870 issued: login with account "wbb"(J8D343B9Myit8K+fmdt48WDqb5I=)
2017-02-24 09:38:34.851277|INFO    |Query         |   |query from 46 xxx.xxx.xxx.xxx:49871 issued: login with account "wbb"(J8D343B9Myit8K+fmdt48WDqb5I=)
2017-02-24 10:11:48.013152|INFO    |Query         |   |query from 47 xxx.xxx.xxx.xxx:49900 issued: login with account "wbb"(J8D343B9Myit8K+fmdt48WDqb5I=)
2017-02-24 10:12:02.227618|INFO    |Query         |   |query from 47 xxx.xxx.xxx.xxx:49903 issued: login with account "wbb"(J8D343B9Myit8K+fmdt48WDqb5I=)
2017-02-24 10:12:09.280333|INFO    |Query         |   |query from 47 xxx.xxx.xxx.xxx:49904 issued: login with account "wbb"(J8D343B9Myit8K+fmdt48WDqb5I=)
2017-02-24 10:12:16.599781|INFO    |Query         |   |query from 47 xxx.xxx.xxx.xxx:49905 issued: login with account "wbb"(J8D343B9Myit8K+fmdt48WDqb5I=)
2017-02-24 10:12:32.392106|INFO    |Query         |   |query from 47 xxx.xxx.xxx.xxx:49908 issued: login with account "wbb"(J8D343B9Myit8K+fmdt48WDqb5I=)
2017-02-24 10:13:01.894397|INFO    |Query         |   |query from 47 xxx.xxx.xxx.xxx:49910 issued: login with account "wbb"(J8D343B9Myit8K+fmdt48WDqb5I=)
2017-02-24 10:13:18.409542|INFO    |Query         |   |query from 47 xxx.xxx.xxx.xxx:49911 issued: login with account "wbb"(J8D343B9Myit8K+fmdt48WDqb5I=)
................................................ etc.....................

There is no new or other entry in that time the spammer is active. Other logs than this or the other I posted are not available in ts3\logs

After I follow your hints in post#1 to close the permission issue I to the self-test:

Telnet without login
use port=9987
sendtextmessage targetmode=1 target=1 msg=Spam! =>

sendtextmessage targetmode=1 target=1 msg=Spam!
notifytextmessage targetmode=1 msg=Spam! target=1 invokerid=6 invokername=Unknown\sfrom\s95.33.19.201:58168 invokeruid=ServerQuery

error id=0 msg=ok

sendtextmessage targetmode=2 target=1 msg=Spam! =>

error id=2568 msg=insufficient\sclient\spermissions failed_permid=217

sendtextmessage targetmode=3 target=1 msg=Spam! =>

error id=2568 msg=insufficient\sclient\spermissions failed_permid=216

And in any 3 cases no message on the Server!!!

Nethertheless every few hours any user on the still server got/get a private message:

"Server": Monitor your TS3 server or game server, custom your banner and more stats : *AdLink Removed*
Chat partner disconnected our of view.

Any idea?

[dante696]

Try this command in case private messages still work for the GuestQuery

servergroupaddperm sgid=1 permsid=i_client_private_textmessage_power permvalue=-999999999 permskip=1 permnegated=1

Targets needed private message power is lower than 0 in case the GuestQuery can send a privat message.
This is why I wrote the hint at the end of the main post.

(Optional Hint:
It could be that this Query still can send pokes and chats to users who own a i_client_needed_private_textmessage_power & i_client_needed_poke_power with a value lower than 0. You have to raise these values to 0 at least to avoid spam for them.)

[Nerd-Factory Dago]

Hey everyone,

some minutes ago our teamspeak server got scammed by a romanian Teamspeak Server, they joined our Teamspeak Server and wrote everyone on it (see images below)




then they took our server down by using DDOS attacks.

Only a short warning for everybody else who is experiencing such scamming, all they want to do is to steal your users.
Hope maybe Teamspeak Support can take their Teamspeak down for doing such things.

- Dago

[pakiko]

Greetings.
We are suffering a DDoS attack since one hour ago. A person logged as an admin, sent this message to every user in the server:

"New server ip: 89.40.105.60.9987 - This server will close in 3 minutes"

And then he drops the TS3 server.

I would like you to block this ip for spaming and annoying attitude and if you can help us to solve this problem. Thank by advance.

[numma_cway]

This is the forum of TeamSpeak Systems GmbH. Noone here will block any IP, because blocking is the job of TeamSpeak USA.

The solution would be not ignoring important updates over several years and reading the changelog.

[KE4KMD]

After last update i have been getting server admin logs from same IP address but account number at end is always different. This is happening way to much through out the day. In fact it also appears and looks like someone is trying to hack. I had tracked the IP address to France.


After talking with other game players in our group that are running the computer version. They are not getting this info so its only on the android version.


Any help or solutions would be good.

[dante696]

What has this to do with Android?
It's the ServerQuery that joins and what you mean is the port number.

Just close the Query port or disallow that someone does anything with the Query Guest group

Thread merged

[Ghett.]

Hello,

I still have a problems with advertisors on my server.

They connect to the server using nickname "ServerAdmin". They spam IP adreses with a message that my server will be closed soon and they have to move to their server.

We ban them asap. I can put these nicknames as "BadNickName" in my bots but I have nothing from it.

Can we report anywhere these server owners? What can I do?
A community should not do this.

Sorry for my english..
[I did not find any topic like this or anathing similar on google)

[JokeNSWE]

Hey guys,

I was just wondering if anyone of you are familiar with TS3Index.com or others like it. One of my friends thought it would be fun to hook up my teamspeak server to TS3Index, and now I have a bot that's joining and leaving under 1 second and reappears every 11 minutes. Once every two days, a bot is joining, poking everyone about a "new server ip-address" and shuts down the server.

Any tips on how to fix this problem that doesn't involve whitelisting?

Thank you for your time! Strongly appreciate it.