0

Earlier today I got an email from my hosting provider that my server is being DDoSed. I found in log file many suspicious requests with some random site names like dekhockeyvicto.com, workout.de and very strange dish_fiber.dedicated:

13/Sep/2017:10:35:21 +0300] "GET http://dish_fiber.dedicated/alogin?dst=http%3A%2F%2Fviewdns.info%2Freverseip%2F%3Fhost%3Ddekhockeyvicto.com%26amp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bt%3D1 HTTP/1.1" 400 0 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.130 Safari/537.36"
52.119.20.4 - - [13/Sep/2017:10:56:46 +0300] "GET http://dish_fiber.dedicated/alogin?dst=http%3A%2F%2Fviewdns.info%2Freverseip%2F%3Fhost%3Dworkout.de%26amp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bt%3D1 HTTP/1.1" 400 0 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.130 Safari/537.36"

What is it? Is it DNS flood type DDoS atack or what? Please help.

4

welcome to the internet.

Someone is trying to use your server as a proxy to attack someone else's machine. It doesn't look like a DOS attack on your server.

Since the attempts have been frequent enough to wake up the people you are paying to provide you with this support it rather implies the attackers are having some success. However your server seems to be correctly responding with a 400 response rejecting the request.

As long as you haven't some something silly like using a custom error handler which returns a large amount of content, there's nothing you can do about this. That's not strictly true - but from your question I get hte impression that you do not have the skills, budget and hosting to tackle the problem.

|improve this answer|||||
1

Being a victim in a DDoS attack doesn't necessarily generate anything in logs: it's just exhausting network bandwidth, which makes your hosting provider worried. If your server was used for such an attack, you might find evidence of intrusion or activities generating traffic from your logs.

When this kind of notice reaches you and you start reading logs you haven't researched before, you will find all kind of unrelated anomalies. I have this same psychological problem with old cars: whenever I believe something might be wrong, even all the noises I should be familiar with sounds all new and alerting. Similarly, there have always been all kind of abnormal queries in your logs.

|improve this answer|||||
  • 1
    The sloloris point is a good one - but surely in 2017 people are not selling hosting without any mitigation? – symcbean Sep 14 '17 at 11:49
  • Unfortunately there are all kind of service providers in business. The story doesn't tell how good this one is. – Esa Jokinen Sep 14 '17 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.