0
votes
1answer
65 views

Attempting to block “wordpress” useragent is overloading CPU [duplicate]

I've had some DDoS issues - specifically the XML-RPC exploit (wordpress) wherein thousands on thousands of Wordpress instances attack my machine. I have the following in my nginx server block: ...
0
votes
0answers
22 views

DDos attack on port 80 and limiting connection does not work [duplicate]

I have a Centos server running apache 2.4 and someone keeps connecting to the server causing http requests to timeout. I have searched the internet for answers to solve this problem and someone asked ...
13
votes
3answers
605 views

Dealing with NTP reflection attacks in IPTables

We're dealing with an NTP reflection / amplification attack at our colocated servers. This question is specific to responding to NTP reflection attacks, and not directed at DDoS in general. Here's ...
-2
votes
1answer
109 views

Server suddenly became too slow with timeout error

My server suddenly became slow, all the websites in it at the http level i have checked all the logs but there is nothing that indicate why it's happening if anyone have any suggestion please my ...
0
votes
0answers
71 views

Site unreachable due to attack - xmlrpc.php

Today our server was not reachable. It was returning a 502. We are running Nginx 1.10 on Ubuntu 14.04. We also use PHP7 (only, no PHP5). In the logs, we got the same error from the same client (2 ...
1
vote
1answer
68 views

How can I modify my cgi to most effectively respond_to/block/whatever a ddos attack? [closed]

I am under DDoS. What can I do? already addresses this kind of "canonical question", but I think I'm asking a distinguishable variant, as described below. But please advise if this post inappropriate. ...
0
votes
0answers
18 views

Mitigation DDOS Attack [duplicate]

I am with the OVH Dedicated server provider and we are under a DDOS attack, The mitigation toggles on and blocks everything on our server. Is there anyway to defend against 300k packets? In the ...
0
votes
1answer
27 views

How to block HSRPv2 protocol? (DDoS??) [duplicate]

I have VPS with Windows Server 2012 R2 on it. And someone want shut it down. And I'm not sure what I can do with it, can someone help me? Check Img for more details
-4
votes
2answers
133 views

Fail2Ban to block IPs that request the same URL repeatedly [duplicate]

Is it possible to use Fail2Ban to block IPs that request the same URL more than 5 times in 10 seconds? I'm not talking about a specific URL, but any random URL of the site that is being requested ...
-2
votes
1answer
65 views

Is this a DDoS attack? It's been overr 48 hours. What do I do? [closed]

I run a Wordpress on EC2 at AWS and I am facing the following issue: More than 2 days ago, the CPU went straight to 100% and the load balance up to ~20+ (for a 4-vcpu server) out of the blue. Being ...
0
votes
2answers
103 views

prevent from ddos attacks with nginx and apache (and haproxy?) [duplicate]

Sometimes i have ddos attacks on my server. I'm trying to prevent from this. I'm using Nginx to serve static content and as a reverse proxy and Apache to serve php applications. When the attack ...
2
votes
3answers
109 views

My server is getting SYN Flooded, i have a few questions

my server is getting attacked, it seems to be a syn flood, and he is spoofing IP's. sudo netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n returns this. .....
1
vote
0answers
53 views

ICMP DDoS, proper ACL?

We are having about a 3-4Gbps ICMP flood on one of our servers and I wonder.. I have a 20gbps of DDoS protection but the proetction seems ineffective against ICMP funnily (it worked well to block a ...
4
votes
0answers
32 views

ransom email, followed by DDos attack [duplicate]

2 days ago, we received an ransom email from Armada Collective, followed by 1 hour of DDos attack. This group has been in the news recently (http://www.forbes.com/sites/thomasbrewster/2015/11/09/...
0
votes
0answers
16 views

Massive DDoS hitting my VPS, no idea what to do [duplicate]

for the past few days there has been a massive amount of connections hitting my VPS. I am not sure whether my VPS is actually being attacked or just being used for DDoSing someone else's server. ...

15 30 50 per page