Essentially, my website is being attacked by a layer 7 XML-RPC attack and is currently offline and has been offline so I am in need of desperate help.

Any assistance would be greatly appreciated :)!

I have a few questions.

1) How do I firewall a list of IPs from my server?

I have a huge list of XML-RPC servers that are being used to attack my website and would like to stop it.

2) How do I block all requests to my direct server IP, for example I am running cloudflare's layer 7 protection. But that is useless if the attacker just attacks the direct server IP.

3) How do I monitor web requests including the request and the IP it's coming from such as how Sucuri did it.

EX: More Than 162,000 WordPress Sites Used for Distributed Denial of Service Attack

Then I could just firewall these IPs using the answer to question 1.

Thank you!

  • Use a default vhost with a dummy servername. Any HTTP requests without a Host: header for one of your "real" sites will then be handled by the default vhost, which can simply give an empty response to any requests. You could also direct all requests to a script that automatically adds the client IP to the firewall e.g. with iptables "recent" matching. – wurtel May 8 '15 at 7:19
  • An appropriate default server + iptables = problem solved. – AD7six May 9 '15 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.