0
votes
0answers
34 views

Site unreachable due to attack - xmlrpc.php

Today our server was not reachable. It was returning a 502. We are running Nginx 1.10 on Ubuntu 14.04. We also use PHP7 (only, no PHP5). In the logs, we got the same error from the same client (2 ...
1
vote
1answer
62 views

How can I modify my cgi to most effectively respond_to/block/whatever a ddos attack? [closed]

I am under DDoS. What can I do? already addresses this kind of "canonical question", but I think I'm asking a distinguishable variant, as described below. But please advise if this post inappropriate. ...
37
votes
6answers
44k views

How can I prevent a DDOS attack on Amazon EC2?

One of the servers I use is hosted on the Amazon EC2 cloud. Every few months we appear to have a DDOS attack on this sever. This slows the server down incredibly. After around 30 minutes, and ...
0
votes
0answers
17 views

Mitigation DDOS Attack [duplicate]

I am with the OVH Dedicated server provider and we are under a DDOS attack, The mitigation toggles on and blocks everything on our server. Is there anyway to defend against 300k packets? In the ...
0
votes
1answer
27 views

How to block HSRPv2 protocol? (DDoS??) [duplicate]

I have VPS with Windows Server 2012 R2 on it. And someone want shut it down. And I'm not sure what I can do with it, can someone help me? Check Img for more details
-4
votes
2answers
98 views

Fail2Ban to block IPs that request the same URL repeatedly [duplicate]

Is it possible to use Fail2Ban to block IPs that request the same URL more than 5 times in 10 seconds? I'm not talking about a specific URL, but any random URL of the site that is being requested ...
-2
votes
1answer
64 views

Is this a DDoS attack? It's been overr 48 hours. What do I do? [closed]

I run a Wordpress on EC2 at AWS and I am facing the following issue: More than 2 days ago, the CPU went straight to 100% and the load balance up to ~20+ (for a 4-vcpu server) out of the blue. Being ...
0
votes
2answers
84 views

prevent from ddos attacks with nginx and apache (and haproxy?) [duplicate]

Sometimes i have ddos attacks on my server. I'm trying to prevent from this. I'm using Nginx to serve static content and as a reverse proxy and Apache to serve php applications. When the attack ...
2
votes
3answers
97 views

My server is getting SYN Flooded, i have a few questions

my server is getting attacked, it seems to be a syn flood, and he is spoofing IP's. sudo netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n returns this. ...
0
votes
2answers
1k views

Protection against Ddos Syn Flood [duplicate]

My dedicated server can't handle more than 4Mbits/s of bandwidth. After that, the server don't ping anymore. My provider told me it's because my server isn't well configured. When I look in the logs ...
1
vote
0answers
48 views

ICMP DDoS, proper ACL?

We are having about a 3-4Gbps ICMP flood on one of our servers and I wonder.. I have a 20gbps of DDoS protection but the proetction seems ineffective against ICMP funnily (it worked well to block a ...
4
votes
0answers
32 views

ransom email, followed by DDos attack [duplicate]

2 days ago, we received an ransom email from Armada Collective, followed by 1 hour of DDos attack. This group has been in the news recently ...
0
votes
0answers
16 views

Massive DDoS hitting my VPS, no idea what to do [duplicate]

for the past few days there has been a massive amount of connections hitting my VPS. I am not sure whether my VPS is actually being attacked or just being used for DDoSing someone else's server. ...
2
votes
1answer
46 views

Thousands of requests with non-existent domains as HTTP_REFERER [duplicate]

For the last few days one of my websites has been receiving hundreds of requests per minute with non-existent random domains as HTTP_REFERER and from different IPs (therefore using deny from IP is not ...
1
vote
1answer
321 views

Exim SMTP reverse proxy [closed]

This is my first post on Serverfault, so if I make some mistakes, please let me know. The issue that I'm dealing with right now is a DDoS attack on my Exim mailserver (cPanel) on port 25. From what I ...

15 30 50 per page