Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Currently experiencing a very mild DDoS attack. Just a brute force login attack. This caused a spike in PHP/MySQL usage so I've just blocked logins except from my IP address. I'm not too worried about this type of attack at the moment.

I was wondering if there is anybody out there who is interested in collecting IP addreses of DDoS clients? Is there a service I can redirect DDoS clients to using a HTTP header (assuming the client will follow location) or is there a service I can post a set of logged IP addresses to?

I'm not even sure if this kind of information would be useful to some of the big DDoS Mitigation crews out there. It's not even a large number of hosts:

# grep 'POST /wp-login' access_log|cut -f1 -d" "|sort -u|wc -l
3198

Cheers, Dave

share|improve this question

1 Answer 1

Short answer is no. The IP addresses are usually compromised public web sites, and number in the range of thousands.

If you can harvest the userid and password used during attacks, it may be useful.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.