How to decrease unwanted traffic after malware attack?

Question

After malware attack on my website I'm seeing more than 20000 get requests every day which are pointing to non existent places on my server. Those addresses were valid during the attack and were displaying undesirable content in Chinees/Japanees language. Due to that my server provider is blocking my server as number of requests is exceeds my limit.

I've alreade performed the following steps to resolved that issue:

1. Placed proper sitemap in google
2. Blocked SemrushBot in robots.txt (User-agent: SemrushBot Disallow: /)
3. Blocked IP from which that bot is pointing my server in .HTACCESS (Order Allow,Deny Deny from 185.191.171.0/24)

After those actions logs from the server are looking as follow:

Additionally I can see in Google Search Console millions of pages indexed under my domain

Could you help me to understand what should I do to reduce that unwanted traffic and fix indexing in Google Search Console?

Answer 1

If all the traffic is coming from the identified IP's, the solution is to block the IP addresses before the traffic gets to the web server. If you are using a Linux box, This means implementing IPTables rules or null routing those IP's.

You can do this at the command line with a command like

 ip route add 10.10.10.10 dev lo

to do this with the routing table. This will stop the connection from establishing because there is no route back to the host. It will stop the traffic hitting the log server, but is arguably not ideal.

A better way might be to use iptables, which would use a command like

iptables -I INPUT -s 10.10.10.10 -j DROP

This will stop the incoming data even being able to be routed from your system, but there is a very small chance it will not behave as desired depending on your rules and your setup.

Both of these commands need to be done as root and will drop ALL traffic from those IP addresses.

That said, it may be best to just "wait it out" on the assumption that these requests, while annoying in your logs, are not taking up significant resources - and are actively advising visitors those pages don't exist so they can fix their indexing.