Essentially, my website is being attacked by a layer 7 XML-RPC attack and is currently offline and has been offline so I am in need of desperate help.
Any assistance would be greatly appreciated :)!
I have a few questions.
1) How do I firewall a list of IPs from my server?
I have a huge list of XML-RPC servers that are being used to attack my website and would like to stop it.
2) How do I block all requests to my direct server IP, for example I am running cloudflare's layer 7 protection. But that is useless if the attacker just attacks the direct server IP.
3) How do I monitor web requests including the request and the IP it's coming from such as how Sucuri did it.
EX: More Than 162,000 WordPress Sites Used for Distributed Denial of Service Attack
Then I could just firewall these IPs using the answer to question 1.
Thank you!
iptables
"recent" matching.