0

Essentially, my website is being attacked by a layer 7 XML-RPC attack and is currently offline and has been offline so I am in need of desperate help.

Any assistance would be greatly appreciated :)!

I have a few questions.

1) How do I firewall a list of IPs from my server?

I have a huge list of XML-RPC servers that are being used to attack my website and would like to stop it.

2) How do I block all requests to my direct server IP, for example I am running cloudflare's layer 7 protection. But that is useless if the attacker just attacks the direct server IP.

3) How do I monitor web requests including the request and the IP it's coming from such as how Sucuri did it.

EX: More Than 162,000 WordPress Sites Used for Distributed Denial of Service Attack

Then I could just firewall these IPs using the answer to question 1.

Thank you!

2
  • Use a default vhost with a dummy servername. Any HTTP requests without a Host: header for one of your "real" sites will then be handled by the default vhost, which can simply give an empty response to any requests. You could also direct all requests to a script that automatically adds the client IP to the firewall e.g. with iptables "recent" matching.
    – wurtel
    May 8, 2015 at 7:19
  • An appropriate default server + iptables = problem solved.
    – AD7six
    May 9, 2015 at 11:54

0

You must log in to answer this question.

Browse other questions tagged .