1

One of my clients website is getting massive traffic from China most of which are bots. These bots are hitting the site nonstop causing the VM to use very high cpu and memory. As a result it is costing my client my as the site is hosted on cloud.

I have Blocked most of the IPs. I even blocked the whole country but that does not seem to help. Still the site is getting massive amount of hits per minute.

These bots are hitting one specific URL which had a Email form. I removed the email form. Changed the URL and even redirected the old url to a different site.

But none of these seem to have any effect of the CPU and RAM usage. Any help is appreciated.

Thanks

Improve this question
3
  • China hackers can be relentless. One site I had got 100,000 requests per hour for many months. Redirect still returns 200 response code. A 403 would be better. Even then using a firewall would be better. That is what I did. You can use ipchains or something similar. Fail2Ban should help. Or Mod_Securty. Cheers!!
    – closetnoc
    Commented Apr 7, 2017 at 16:58
  • Use a transparent proxy... such as Cloudflare, let them absorb the bots and not your hosting. Also, why is a contact form consuming resources in the first place? especially RAM since ram usage is normally associated mostly with SQL queries and not something a contact form should use unless you have it doing DB writes. Finally, the page should also a captcha service that way no PHP action other the a standard FETCH request which should have minimal effect on CPU unless your VM is seriously unpowered.
    – Simon Hayter
    Commented Apr 7, 2017 at 17:28
  • The form was the reason they started botting the URL. I have removed the form altogether. Changed the url, added captcha on comments, login and registration forms. The main problem is thats the bots hit the site in hundreds and they keep hitting it every second thats the reason for the high cpu and ram usage.
    – arifur
    Commented Apr 8, 2017 at 6:10

1 Answer 1

Reset to default
1

Block IP Addresses

If you find that certain IP addresses are hitting your site over and over, you can block them individually in .htaccess

Order Deny,Allow
Deny from 1.1.1.1
Deny from 2.2.2.2
Deny from 3.3.3.3

Too many rules are required to block entire regions of the world by IP address in .htaccess. For example blocking the US would require 150,000 lines of text. (Source)

Block User Agents

If the bots are not spoofing major browsers, you can block them by user agent:

# Bot Blocker
<IfModule mod_setenvif.c>
  SetEnvIfNoCase User-Agent ^$ keep_out
  SetEnvIfNoCase User-Agent (pycurl|casper|cmsworldmap|diavol|dotbot) keep_out
  SetEnvIfNoCase User-Agent (flicky|ia_archiver|jakarta|kmccrew) keep_out
  SetEnvIfNoCase User-Agent (purebot|comodo|feedfinder|planetwork) keep_out
  <Limit GET POST PUT>
    Order Allow,Deny
    Allow from all
    Deny from env=keep_out
  </Limit>
</IfModule>

(Source)

Other techniques

This article has a number of other techniques that you can use. The article explains each one very well, so it would be better to read the details about each one there.

  • Find hosting that does the blocking
  • Use a CDN
  • Install Apache modules such as MaxMind
  • Implement blocking in your application (such as PHP)
  • Use routing tables
  • Use ModSecurity on the webserver
  • Use a proxy service such as CloudFlare
Improve this answer
1
  • I tried to block IPs they they seem to have a massive amount of IPs. But yes blocking whole regions seems to be the only way to block them. Thanks for the advice.
    – arifur
    Commented Oct 14, 2017 at 9:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.