1

My website is under attack. In this last 2 days I have identified and blocked ~20 IPs especially from China (and Taiwan, Malaysia, Egypt, Ireland, Spain and Russia)

This are some of the 20 ips:

95.74.78.55
222.124.156.230
113.108.166.57
125.41.130.120
115.64.76.208
210.5.147.148
117.139.54.192
118.100.12.250
58.251.109.127
61.50.164.157
217.217.131.108
41.236.224.217
151.82.45.148

Is there a way to understand why this is happening and maybe find who is the mandator?

Add

These ip are requesting the same file thousands time/minute. I block one IP after it has made the 250th requests.

Improve this question
2
  • Can you give us some relevant excerpts from your access/error logs please so we can assess the type of attack.
    – user9517
    May 21, 2011 at 11:29
  • What you need? In my log I See the same request coming from the same IP to the same file hosted in my server thousands of time
    – dynamic
    May 21, 2011 at 11:30

5 Answers 5

Reset to default
3

If it is really a distributed DoS attack (How do you know? If there are merely connection attempts, it simply could be malware...), it is typically performed through a botnet - exploited and trojanized computers of unknowing people controlled by some third party. There is little chance to find out who's behind this, but if you have more evidence, a larger impact on the availability of your site and maybe a blackmailing letter, you should forward the data to the police.

Improve this answer
2
  • Well actually my website isn't getting any slower because I am able to block this ip when they make their 250th request. but still it's getting annoying. Thanks anyway
    – dynamic
    May 21, 2011 at 10:23
  • If it was dynamic content that takes considerable CPU and memory resources to build, I might be inclined to agree, but just fetching the same static file does not sound very "denial of service" to me.
    – the-wabbit
    May 21, 2011 at 18:58
2

It's happening because you have a system connected to the internet. There may be other causes of course as to why you in particular right now, but you have to understand that dealing with this kind of stuff is simply part of the cost of having an online presence.

How are you determining they are attacking you? What form does the attack take? At the moment you've given us no information to help you find out if you have a particular problem.

Improve this answer
1
  • The attack is: an ip request the same file over and over. I determ it because i see in my log the smae ip requesting the same file thousands of time
    – dynamic
    May 21, 2011 at 11:26
1

Keep blocking the IP addresses like you are already doing. It sounds to me like the attacker targeting your website has pretty limited resources (20 IP's is a very small amount). Your website could be a deliberate target or it could be a random target chosen to test the DoS capabilities of their little network of bots or shells. The attack probably won't last very long, especially if they see that it isn't effective.

Improve this answer
1

You can also simply block whole ranges of IPs if you have nothing anyone in china, or taiwan has any business with (eg not a blog but a company website that doesn't do business in china or russia). While it wouldn't stop a full botnet attack, it should help take some pressure off

Improve this answer
1

Just block China's subnet with iptables

Improve this answer
1
  • if you read the couple of line i wrote in my first post you see there isn't only china
    – dynamic
    May 22, 2011 at 3:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .