Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently experiencing a very mild DDoS attack. Just a brute force login attack. This caused a spike in PHP/MySQL usage so I've just blocked logins except from my IP address. I'm not too worried about this type of attack at the moment.

I was wondering if there is anybody out there who is interested in collecting IP addreses of DDoS clients? Is there a service I can redirect DDoS clients to using a HTTP header (assuming the client will follow location) or is there a service I can post a set of logged IP addresses to?

I'm not even sure if this kind of information would be useful to some of the big DDoS Mitigation crews out there. It's not even a large number of hosts:

# grep 'POST /wp-login' access_log|cut -f1 -d" "|sort -u|wc -l

Cheers, Dave

share|improve this question

Short answer is no. The IP addresses are usually compromised public web sites, and number in the range of thousands.

If you can harvest the userid and password used during attacks, it may be useful.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.