confluence is not running
Asked by Rakesh Kumar Srivastava:

I am unable to start confluence. I am getting below error.

"This site can not be reached"

![error.png](/t5/image/serverpage/image-id/51483i72DCF33FDDD68DE7/image-size/large?v=v2&px=999 "error.png")


Answers:
author: Daniel Eads
body: Hey [@Rakesh Kumar Srivastava](/t5/user/viewprofilepage/user-id/2133868) ,

It looks like you are running Confluence 6.2.0 which is vulnerable to a malware attack we've seen in the wild. The symptoms you described match an active exploit that attacks the CVE-2019-3396 Widget Connector vulnerability from March 20th ([see Confluence Security Advisory - 2019-03-20](https://confluence.atlassian.com/doc/confluence-security-advisory-2019-03-20-966660264.html)). We've seen attackers infect servers with malware that tries to mine bitcoin. The malware runs under the confluence system user account, consumes all the CPU, and relaunches itself every few minutes if you kill the process.

The first step in fixing this is upgrading Confluence. The latest releases are:

* 6.6.13 (6.6 is an [Enterprise release](https://confluence.atlassian.com/enterprise/atlassian-enterprise-releases-948227420.html))
* 6.12.4
* 6.13.4 (6.13 is an [Enterprise release](https://confluence.atlassian.com/enterprise/atlassian-enterprise-releases-948227420.html))
* 6.14.3
* 6.15.2

Secondly, the [LSD malware cleanup tool](https://git.laucyun.com/security/lsd_malware_clean_tool/blob/master/README.md) will be useful for removing the Kerberods malware. I would recommend executing cleanup *after*upgrading Confluence to a patched version so there's no possibility of re-infection while you work on the upgrade.

Please let me know if you have more questions!  
Daniel \| Atlassian Support

comments: author: Rakesh Kumar Srivastava
body: Hi [@Daniel Eads](/t5/user/viewprofilepage/user-id/1527694)

After upgrading the version, It shows blank white screen.

When i see page source, following code is showing

|-------------------|---------------------------------------------------------------------------------------------------------------|
| \<!DOCTYPE html\> |
|                   | \<html\>                                                                                                      |
|                   | \<head\>                                                                                                      |
|                   | \<meta charset="utf-8"\>                                                                                      |
|                   | \<style type="text/css"\>                                                                                     |
|                   | html, body, #partner, iframe {                                                                                |
|                   | height:100%;                                                                                                  |
|                   | width:100%;                                                                                                   |
|                   | margin:0;                                                                                                     |
|                   | padding:0;                                                                                                    |
|                   | border:0;                                                                                                     |
|                   | outline:0;                                                                                                    |
|                   | font-size:100%;                                                                                               |
|                   | vertical-align:baseline;                                                                                      |
|                   | background:transparent;                                                                                       |
|                   | }                                                                                                             |
|                   | body {                                                                                                        |
|                   | overflow:hidden;                                                                                              |
|                   | }                                                                                                             |
|                   | \</style\>                                                                                                    |
|                   | \<meta content="NOW" name="expires"\>                                                                         |
|                   | \<meta content="index, follow, all" name="GOOGLEBOT"\>                                                        |
|                   | \<meta content="index, follow, all" name="robots"\>                                                           |
|                   | \<!-- Following Meta-Tag fixes scaling-issues on mobile devices --\>                                          |
|                   | \<meta content="width=device-width; initial-scale=1.0; maximum-scale=1.0; user-scalable=0;" name="viewport"\> |
|                   | \</head\>                                                                                                     |
|                   | \<body\>                                                                                                      |
|                   | \<div id="partner"\>\</div\>                                                                                  |
|                   | \<script type="text/javascript"\>                                                                             |
|                   | document.write(                                                                                               |
|                   | '**\<script type="text/javascript" language="JavaScript"'**                                                   |
|                   | **+ 'src="//sedoparking.com/frmpark/'**                                                                       |
|                   | **+ window.location.host + '/'**                                                                              |
|                   | **+ 'IONOSParkingUS'**                                                                                        |
|                   | **+ '/park.js"\>'**                                                                                           |
|                   | **+ '\<\\/script\>'**                                                                                         |
|                   | );                                                                                                            |
|                   | \</script\>                                                                                                   |
|                   | \</body\>                                                                                                     |
|                   | \</html\>                                                                                                     |


author: Daniel Eads
body: Hi Rakesh,

This looks like the type of domain parking screen you see if your domain name registration has expired. Are you trying to access Confluence via a domain name (like "yourdomain.com") and is the registration for that site still valid?

You can check a domain's status by using the official [ICANN whois tool](https://whois.icann.org/en).

Cheers,  
Daniel


author: Rakesh Kumar Srivastava
body: I have checked domain status by [CANN whois tool](https://whois.icann.org/en)., all things is looking good. But problem is same.


author: Bastian Stehmann
body: Hi [@Rakesh Kumar Srivastava](/t5/user/viewprofilepage/user-id/2133868) ,

You should have a look at the logs, especially the atlassian-confluence.log or maybe also the Catalina.out to see what errors are logged there.

comments: author: Rakesh Kumar Srivastava
body: Following content is from Catalina.out

15-Apr-2019 10:23:38.404 WARNING \[main\] org.apache.tomcat.util.digester.SetPropertiesRule.begin \[SetPropertiesRule\]{Server} Setting property 'debug' to '0' did not find a matching property.  
15-Apr-2019 10:23:38.599 WARNING \[main\] org.apache.catalina.startup.SetAllPropertiesRule.begin \[SetAllPropertiesRule\]{Server/Service/Connector} Setting property 'debug' to '0' did not find a matching property.  
15-Apr-2019 10:23:38.625 WARNING \[main\] org.apache.tomcat.util.digester.SetPropertiesRule.begin \[SetPropertiesRule\]{Server/Service/Engine} Setting property 'debug' to '0' did not find a matching property.  
15-Apr-2019 10:23:38.638 WARNING \[main\] org.apache.tomcat.util.digester.SetPropertiesRule.begin \[SetPropertiesRule\]{Server/Service/Engine/Host} Setting property 'debug' to '0' did not find a matching property.  
15-Apr-2019 10:23:38.720 WARNING \[main\] org.apache.tomcat.util.digester.SetPropertiesRule.begin \[SetPropertiesRule\]{Server/Service/Engine/Host/Context} Setting property 'debug' to '0' did not find a matching property.  
15-Apr-2019 10:23:38.772 WARNING \[main\] org.apache.tomcat.util.digester.SetPropertiesRule.begin \[SetPropertiesRule\]{Server/Service/Engine/Host/Context} Setting property 'debug' to '0' did not find a matching property.  
15-Apr-2019 10:23:39.499 INFO \[main\] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler \["http-nio-8090"\]  
15-Apr-2019 10:23:39.544 INFO \[main\] org.apache.tomcat.util.net.NioSelectorPool.getSharedSelector Using a shared selector for servlet write/read  
15-Apr-2019 10:23:39.551 INFO \[main\] org.apache.catalina.startup.Catalina.load Initialization processed in 1284 ms  
15-Apr-2019 10:23:39.582 INFO \[main\] org.apache.catalina.core.StandardService.startInternal Starting service Tomcat-Standalone  
15-Apr-2019 10:23:39.583 INFO \[main\] org.apache.catalina.core.StandardEngine.startInternal Starting Servlet Engine: Apache Tomcat/8.0.41  
15-Apr-2019 10:23:44.960 INFO \[localhost-startStop-2\] org.apache.catalina.core.ApplicationContext.log Spring WebApplicationInitializers detected on classpath: \[com.atlassian.synchrony.proxy.SynchronyDispatcherServletInitializer@25a328d0\]  
15-Apr-2019 10:23:45.842 INFO \[localhost-startStop-2\] org.apache.catalina.core.ApplicationContext.log Initializing Spring FrameworkServlet 'dispatcher'  
15-Apr-2019 10:23:45.857 INFO \[localhost-startStop-2\] org.springframework.web.servlet.DispatcherServlet.initServletBean FrameworkServlet 'dispatcher': initialization started  
15-Apr-2019 10:23:45.889 INFO \[localhost-startStop-2\] org.springframework.web.context.support.AnnotationConfigWebApplicationContext.prepareRefresh Refreshing WebApplicationContext for namespace 'dispatcher-servlet': startup date \[Mon Apr 15 10:23:45 UTC 2019\]; root of context hierarchy  
15-Apr-2019 10:23:46.126 INFO \[localhost-startStop-2\] org.springframework.web.context.support.AnnotationConfigWebApplicationContext.loadBeanDefinitions Registering annotated classes: \[class com.atlassian.synchrony.proxy.websocket.WebSocketConfig,class com.atlassian.synchrony.proxy.web.SynchronyWebMvcConfig\]  
2019-04-15 10:23:46,691 INFO \[localhost-startStop-1\] \[com.atlassian.confluence.lifecycle\] contextInitialized Starting Confluence 6.2.0 \[build 7111 based on commit hash 583f3f4010922d699723a091097524472954c767\] - synchrony version 0.3.1-release-confluence_6.1-e20fb944  
15-Apr-2019 10:23:47.878 INFO \[localhost-startStop-2\] org.springframework.scheduling.concurrent.ThreadPoolTaskScheduler.initialize Initializing ExecutorService 'defaultSockJsTaskScheduler'  
15-Apr-2019 10:23:48.790 INFO \[localhost-startStop-2\] org.springframework.web.socket.server.support.WebSocketHandlerMapping.registerHandler Mapped URL path \[/sockjs/v1/\*\*\] onto handler of type \[class org.springframework.web.socket.sockjs.support.SockJsHttpRequestHandler\]  
15-Apr-2019 10:23:49.725 INFO \[localhost-startStop-2\] org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping.register Mapped "{\[/healthcheck\]}" onto public com.atlassian.synchrony.proxy.web.HealthCheckResult com.atlassian.synchrony.proxy.web.SynchronyProxyRestController.getSynchronyProxyInfo()  
15-Apr-2019 10:23:49.727 INFO \[localhost-startStop-2\] org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping.register Mapped "{\[/reload\],methods=\[PUT\]}" onto public org.springframework.http.ResponseEntity com.atlassian.synchrony.proxy.web.SynchronyProxyRestController.reloadConfiguration(com.atlassian.synchrony.proxy.web.SynchronyProxyConfigPayload)  
15-Apr-2019 10:23:49.803 INFO \[localhost-startStop-2\] org.springframework.web.servlet.handler.SimpleUrlHandlerMapping.registerHandler Mapped URL path \[/\*\*\] onto handler of type \[class org.springframework.web.servlet.resource.DefaultServletHttpRequestHandler\]  
15-Apr-2019 10:23:49.958 INFO \[localhost-startStop-2\] org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.initControllerAdviceCache Looking for @ControllerAdvice: WebApplicationContext for namespace 'dispatcher-servlet': startup date \[Mon Apr 15 10:23:45 UTC 2019\]; root of context hierarchy  
15-Apr-2019 10:23:50.497 INFO \[localhost-startStop-2\] org.springframework.context.support.DefaultLifecycleProcessor.start Starting beans in phase 2147483647  
15-Apr-2019 10:23:50.592 INFO \[localhost-startStop-2\] org.springframework.web.servlet.DispatcherServlet.initServletBean FrameworkServlet 'dispatcher': initialization completed in 4735 ms  
2019-04-15 10:23:55,388 INFO \[localhost-startStop-1\] \[atlassian.confluence.cluster.DefaultClusterConfigurationHelper\] lambda$populateExistingClusterSetupConfig$1 Populating setup configuration if running with Cluster mode...


author: Rakesh Kumar Srivastava
body: When i restart confluence then it automatically shut down after 4-5 seconds


Tags: confluence-server

server