nginx web server with
ubuntu machine and I have been harassed for some time with this simple yet very effective DDoS method that is based on sites that validate given input in terms of markup validity of HTML and so on. The attacker may use only one IP address to send all those 'validation requests' and then my site gets flooded with requests from hundreds of IPs from different locations, that data is basically randomized.
To give a brief example of what I'm dealing with, a sample script can be found here.
Requests come from various addresses with different user agents so it's hard to repel it, what I've done is that I've logged every request that contained invalid
GET parameters and blocked associated IP, but I've already blocked hundreds of them and it was still counting, after a while attackers changed that to perfectly valid address. The usual scenario is that my
php5-fpm is fully flooded with those requests and is unable to serve more.
Is there anything I can do to prevent that kind of attack? I've thought about closing the connection if it takes too long to proceed, something like that may be helpful?