1

I checked my raw access files after being notified that my site has been limited over the last 24 hours and see different IP addresses trying to access files with .aspx extensions, see attached log image.

What are they trying to do and how can they be coming in every millisecond or so from different IP addresses?

snapshot of raw access logs

I thought I'd update my question because this continues to happen and for the first time a request with no IP Address - see third log entry

NO IP Address on POST

|improve this question
  • 3
    These look like hack attempts from several already compromised systems trying to replicate a payload. I assume you are using a Microsoft computer since the response code is 403. It is possible the response code is encouraging the hack. Make sure your software, all of it, is up to date. Not knowing Microsoft products any more, I cannot advise you. However, if your software is up to date and your system continues to return a 403, then you should be safe from these attacks. – closetnoc Jul 27 '17 at 3:25
  • 1
    I'm not using a Microsoft computer and this has nothing to do with my computer. The screenshot is an excerpt from Raw Access Logs from one of the sites on a shared server account. None of my sites are ASP sites and I have 403 redirects set up on all of the sites for forbidden sections of the sites in htaccess, so the server is right to return 403's. My question is about the different IP addresses, how could this be coming from so many IP addresses and what are they trying to do? – zod Jul 27 '17 at 3:30
  • 2
    as closetnoc said, they are hacking attempts. I get them hundreds of times a day on my server. Its normal. – Mike Jul 27 '17 at 3:52
  • 2
    While I appreciate a good ole 403, you may be encouraging the attack. It is far better to return a 404. I am very aware of what this is. I studied attack signatures for over a decade. You can block these IP addresses in your firewall if you have one. I run two with an IP gap. I recommend them when possible. – closetnoc Jul 27 '17 at 4:17
  • 1
    ...but what about the IP addresses... What about them? These are compromised computers on the net. As the attack advances, you can see more. Ignore them or block them. You cannot stop the attacks. – closetnoc Jul 27 '17 at 4:20
2

You're either under attack (DDoS) or you're very popular and this is legitimate traffic (however, considering '403' the last is unlikely). And yes, if you've received this IP only recently then the requests are legitimate traffic to the previous owner of your IP.

There are quite a few ways to protect, and the most effective of them is a third-party CDN with such option. To name a few: CloudFlare, MaxCDN, Anazon CloudFront. Even without DDoS-protection CDN should be effective because it should cache '403' Unsure but it can have better effect if you respond with 404 instead of 403.

|improve this answer
  • all our sites are already going through Cloudflare, I'll check the logs again today and see if it is still continuing – zod Aug 1 '17 at 23:39
  • you are right my provider is under a DDoS attack and it is continuing – zod Aug 4 '17 at 6:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.