2

My apache webservice is getting a large quantity of requests over the days, each one with somewhat random login to gain access.
I identified about 60 such ips(a few sample below), all belong to google. is there a way to find more information about the origin of the attacker? or should I just block these ips. secondly, should I attempt to block the identified ips subnets(74.125.46.*) as a preventive measure?

72.14.194.65
64.233.172.20
74.125.75.19
72.14.194.33
74.125.46.87
74.125.44.91
74.125.46.91
Improve this question
2
  • 2
    if they all belong to google, it may be google itself accessing the site for caching and such, are these all login attempts? or just accesses?
    – Jimsmithkka
    Feb 12, 2011 at 6:46
  • these are specific webservice requests with generated username and passwords, clearly with attempt to gain access
    – user12145
    Feb 12, 2011 at 9:18

4 Answers 4

Reset to default
3

You can save yourself against such DOS attacks by IPTABLE rate limiting.
http://blog.bodhizazen.net/linux/prevent-dos-with-iptables/
other than that fail2ban is one more script which can help you to some extent
http://www.the-art-of-web.com/system/fail2ban/

Improve this answer
1
  • but how do I distinguish the legitimate requests which will also be high traffic from single ips?
    – user12145
    Feb 13, 2011 at 5:31
3

When suspecting an attack on your site, the first question you have to ask is, is it really intentionally malicious? In your case, consider the possibility that a misdirected webspider might trigger these. Do you have a robots.txt in place?

Have you taken a look at the User-Agent? Requests coming from Google should identify as whatever service is trying to access your site. Spider User-Agent strings often contain an URL which contains more information about them.

Improve this answer
1

If these are all random IPs in random ranges then its most likely a botnet that has decided to attack your site, not people. So blocking them could block some legitimate people. And what happens when the IP gets reassigned?

You should really solve this with standard brute force protection for logins. Eg only 10 tries in 10 minutes, with sometime around 3-5 requiring answering a captcha. This way the bots will just stop eventually since they can never login.

The only time I would resort to an IP ban is when an IP is doing so many requests that its affecting performance or eating up considerable bandwidth. Only then do the benefits outweigh the inconvenience of whoever has that IP.

Improve this answer
1
  • these are not really random, all of them belong to google according to Arin. Also captcha would not work since these are not directed to webpages, but a webservice. Of course all of these attempts would not login successfully. But the http requests alone toward apache is creating an annoyance.
    – user12145
    Feb 12, 2011 at 4:46
0

Chances are these are against port 80 or 443 - and are "google-bot." There are a few things that you can do - one is using mod_bandwidth and limiting a user another is setting up a robots.txt file -

We have recently started using a Cloud Firewall which has been a huge success - in fact did it for the GroundHog site - which grew from having just under 30 hits a day to 2.2Million on Ground Hog Day - 300K per hour @ some points in time

Might be worth peeking @ if it helps you - they have a free and a paid version - however the FREE worked just fine for that amount of traffic - its called Cloud Flare.

The other suggestions here are all good.

  1. mod_Bandwidth
  2. Firewall
  3. Brute Force Detection

Hope that helps you a bit.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .