DDoS attack, how to stop?

Question

My VPS is under a DDoS attack.

I cannot access RDP and I cannot take it offline.

I cannot do anything at all.

What would you recommend?

They are not trying to bruteforce, just trying to stop access to the VPS.

I don't know if maybe the datacenter messed up or something, but the VPS is online and denying all requests as is normal when under DDoS.

Now, I know the administrator of the dedi, should I get them to check logs or something?

How can I check ping records when the attack is done?

It actually amuses me that someone would go out of their way to attack this vps as nothing major is even running on it lol.

I don't know much about DDoS attacks, do they usually stop after a few days?

Thanks so much, I am not sure whether to be worried or amused. Windows Firewall is enabled and everything, but that doesnt stop DDoS.

Is there an existing anti-ddos program or something?

Answer 1

There is no easy way to stop DDoS attacks. Get in touch with your provider and ask them for help. No program will help you against a DDoS which is intended to consume your bandwidth, you can only absorb these attacks by having more capacity and working with your upstream providers to dismantle the attack.

Answer 2

Compared to hard- or software failure, DDoS is a rare occurence. Your system just being unreachable is no proof whatsoever.

If your system were under a good solid DDoS, you wouldnt be able to reach it at all. No ping, no nothing, and the dedicated server would be off too, perhaps along with the entire datacenter. Just "RDP not responding" probably is a sign of a DDoS not happening.

Try getting the VPS rebooted. Check if the host is alive and well. Check network, duplicate IPs, gateways, firewalls, updates, etc.

Is a VPS within the EULA of the host? Perhaps the provider interferes with the NAT or bridging?

Answer 3

Open a ticket with your hosting company. Hopefully, they can put up a block upstream.

Answer 4

In my days in the hosting industry, its very rare that the attack happened because of the legitimate content of the site. It usually because the account has been compromised and used to host bots, copyrighted-infringing material or other potentially illegal files/scripts.

Assuming that you do get back in, you'll have to audit the web applications on your server and make sure that the appropriate updates were applied or taken offline Your ISP may be able to assist you in determining what invited the DDOS (likely at a nominal cost). Hopefully, the server is not rooted - if that happens, it may have to be re-imaged.