2

For a few days now one of my websites (a local travel guide) has been getting a massive number of hits from Chinese IP addresses. This is to the point that my log files are 10 times bigger and my modsecurity log is over 100 times bigger than usual.

The IP addresses are very fluid. I currently have over 5,000 banned in Fail2Ban, and this is with a China-based IPv4 block in the htaccess.

The user agents for these hits are nearly all either LieBaoFast, MQQBrowser, Mb2345Browser or MicroMessenger.

The pages they are hitting are a dynamic search page e.g. search-accommodation?param=1&param2=2 However, they are calling loads of parameters - which puts extra stress on the server.

So, my question is why? Basically what is going on? I can't see scraping my (affiliate generated) accommodation listings are of benefit to anyone, and if it is some sort of DDOS that's even weirder as this site isn't even important to me?!

3
  • This does not appear to be a DDoS attack. DDoS attacks are decidedly different and very aggressive to the tune of 100,000 or more requests per hour. You are being hit by Chinese scraper bots. You can find out more here. johnlarge.co.uk/…
    – closetnoc
    Dec 20, 2019 at 3:03
  • @closetnoc Yes, this is pretty much what I experienced. However, I was getting about 10 requests per second at one point and the spread of IP addresses is huge. Fortunately my server can cope but it is just kind of annoying as there is no reason to scrape or take down this particular site... Dec 20, 2019 at 11:04
  • Scraper bots from China can be very abusive. I agree. I have experienced them myself. I would advise blocking IP ranges instead if single IPs. I know that the tools you are using are blocking the IPs. Where you can, convert these to IP ranges. For example, I know that mod_security will allow rules to block IP ranges. You can use whois.domaintools.com to look up some IP address blocks. There is a limit to how many you can look up each day but this is one good site. There are more sites of course, however, I have found quite a few to be inaccurate.
    – closetnoc
    Dec 20, 2019 at 16:35

2 Answers 2

1

Does sound like a bot / DDOS traffic. It doesn't matter that the site isn't important to you... these attacks aren't always targeted manually.

Some bot thought you were a good target and you're on the hot list.

Why? Unlikely to find out. You should just make sure you have controls in place to counter any harm to your website. Many hosts offer DDoS protection, but there's also services like CloudFlare.

If you're using something like Google Analytics, you can filter traffic by IPs or user-agents to avoid counting spam traffic as genuine visitors.

2
  • Strangely there is not even a blip in Google Analytics - unlike my Apache CPU usage... Dec 19, 2019 at 14:39
  • The hits aren't waiting for the entire page to load then. Makes it lean more towards an attack attempt
    – AliIshaq
    Dec 19, 2019 at 14:46
0

Every device connected to the internet WILL receive traffic, this is the biggest reason why it needs needs to be secured.

You can setup filters on your google analytics to prevent this and some Content Distribution Networks (CDNs) like Cloudflare have features to help with filtering before it reaches your site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.