I have a small games site with 400 members (~50 active) built around a MySQL database. I'm the sole developer, and I'm an amateur, so I make my fair share of mistakes.
To help protect myself, the site, and my members' contributions I have the server setup to die hard with a plain text "we've experienced an error" message and auto-email me the PHP error information.
Of course this would never work in a corporate environment, much too heavy-handed, but my members are understanding since we've grown the site together and I have personal relationships with most of them. They're also generally technically-unsavvy old men, which means fail-soft situations would be confusing for them.
The site also uses PDO, everywhere.
I woke up this morning to 90 error emails. Unusual!
All of which were triggered in a 2 minute window... most unusual!
The error messages were things like
PDOStatement::execute() expects parameter 1 to be array, string given
which, having looked at my code, is not possible without outside interference.
So I go grab my traffic logs and find that IP 18.104.22.168 based out of Tokyo is hammering my site with requests like:
the first bit of that:
GET /search.php?type=basic is valid and listed in the main nav. Everything else (s)he (it?) is appending.
Looks like a simple
Bobby Tables attack.
So that went on for several minutes and 100 or so calls, and then it stopped.
MY question to you fine folks is:
Should I bother trying to take any action against this IP?
or is this just the price of visibility and too frequent to be bothered with?
do you ban the IP? the subnet? do you contact the ISP?
Just curious what professional server admins do in these sorts of situations, as I imagine it must happen extremely frequently...?