Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My website is under attack. In this last 2 days I have identified and blocked ~20 IPs especially from China (and Taiwan, Malaysia, Egypt, Ireland, Spain and Russia)

This are some of the 20 ips:

Is there a way to understand why this is happening and maybe find who is the mandator?


These ip are requesting the same file thousands time/minute. I block one IP after it has made the 250th requests.

share|improve this question
Can you give us some relevant excerpts from your access/error logs please so we can assess the type of attack. – Iain May 21 '11 at 11:29
What you need? In my log I See the same request coming from the same IP to the same file hosted in my server thousands of time – dynamic May 21 '11 at 11:30

If it is really a distributed DoS attack (How do you know? If there are merely connection attempts, it simply could be malware...), it is typically performed through a botnet - exploited and trojanized computers of unknowing people controlled by some third party. There is little chance to find out who's behind this, but if you have more evidence, a larger impact on the availability of your site and maybe a blackmailing letter, you should forward the data to the police.

share|improve this answer
Well actually my website isn't getting any slower because I am able to block this ip when they make their 250th request. but still it's getting annoying. Thanks anyway – dynamic May 21 '11 at 10:23
If it was dynamic content that takes considerable CPU and memory resources to build, I might be inclined to agree, but just fetching the same static file does not sound very "denial of service" to me. – the-wabbit May 21 '11 at 18:58

It's happening because you have a system connected to the internet. There may be other causes of course as to why you in particular right now, but you have to understand that dealing with this kind of stuff is simply part of the cost of having an online presence.

How are you determining they are attacking you? What form does the attack take? At the moment you've given us no information to help you find out if you have a particular problem.

share|improve this answer
The attack is: an ip request the same file over and over. I determ it because i see in my log the smae ip requesting the same file thousands of time – dynamic May 21 '11 at 11:26

Keep blocking the IP addresses like you are already doing. It sounds to me like the attacker targeting your website has pretty limited resources (20 IP's is a very small amount). Your website could be a deliberate target or it could be a random target chosen to test the DoS capabilities of their little network of bots or shells. The attack probably won't last very long, especially if they see that it isn't effective.

share|improve this answer

You can also simply block whole ranges of IPs if you have nothing anyone in china, or taiwan has any business with (eg not a blog but a company website that doesn't do business in china or russia). While it wouldn't stop a full botnet attack, it should help take some pressure off

share|improve this answer

Just block China's subnet with iptables

share|improve this answer
if you read the couple of line i wrote in my first post you see there isn't only china – dynamic May 22 '11 at 3:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.