1

My website is under attack. In this last 2 days I have identified and blocked ~20 IPs especially from China (and Taiwan, Malaysia, Egypt, Ireland, Spain and Russia)

This are some of the 20 ips:

95.74.78.55
222.124.156.230
113.108.166.57
125.41.130.120
115.64.76.208
210.5.147.148
117.139.54.192
118.100.12.250
58.251.109.127
61.50.164.157
217.217.131.108
41.236.224.217
151.82.45.148

Is there a way to understand why this is happening and maybe find who is the mandator?

Add

These ip are requesting the same file thousands time/minute. I block one IP after it has made the 250th requests.

Journeyman Geek
  • 6,977
  • 3
  • 32
  • 50
dynamic
  • 740
  • 6
  • 17
  • 32
  • Can you give us some relevant excerpts from your access/error logs please so we can assess the type of attack. – user9517 May 21 '11 at 11:29
  • What you need? In my log I See the same request coming from the same IP to the same file hosted in my server thousands of time – dynamic May 21 '11 at 11:30

5 Answers5

3

If it is really a distributed DoS attack (How do you know? If there are merely connection attempts, it simply could be malware...), it is typically performed through a botnet - exploited and trojanized computers of unknowing people controlled by some third party. There is little chance to find out who's behind this, but if you have more evidence, a larger impact on the availability of your site and maybe a blackmailing letter, you should forward the data to the police.

the-wabbit
  • 40,737
  • 13
  • 111
  • 174
  • Well actually my website isn't getting any slower because I am able to block this ip when they make their 250th request. but still it's getting annoying. Thanks anyway – dynamic May 21 '11 at 10:23
  • If it was dynamic content that takes considerable CPU and memory resources to build, I might be inclined to agree, but just fetching the same static file does not sound very "denial of service" to me. – the-wabbit May 21 '11 at 18:58
2

It's happening because you have a system connected to the internet. There may be other causes of course as to why you in particular right now, but you have to understand that dealing with this kind of stuff is simply part of the cost of having an online presence.

How are you determining they are attacking you? What form does the attack take? At the moment you've given us no information to help you find out if you have a particular problem.

Rob Moir
  • 31,884
  • 6
  • 58
  • 89
  • The attack is: an ip request the same file over and over. I determ it because i see in my log the smae ip requesting the same file thousands of time – dynamic May 21 '11 at 11:26
1

Keep blocking the IP addresses like you are already doing. It sounds to me like the attacker targeting your website has pretty limited resources (20 IP's is a very small amount). Your website could be a deliberate target or it could be a random target chosen to test the DoS capabilities of their little network of bots or shells. The attack probably won't last very long, especially if they see that it isn't effective.

Bandit
  • 201
  • 1
  • 3
1

You can also simply block whole ranges of IPs if you have nothing anyone in china, or taiwan has any business with (eg not a blog but a company website that doesn't do business in china or russia). While it wouldn't stop a full botnet attack, it should help take some pressure off

Jim B
  • 24,081
  • 4
  • 36
  • 60
1

Just block China's subnet with iptables