2

After malware attack on my website I'm seeing more than 20000 get requests every day which are pointing to non existent places on my server. Those addresses were valid during the attack and were displaying undesirable content in Chinees/Japanees language. Due to that my server provider is blocking my server as number of requests is exceeds my limit.

I've alreade performed the following steps to resolved that issue:

  1. Placed proper sitemap in google
  2. Blocked SemrushBot in robots.txt (User-agent: SemrushBot Disallow: /)
  3. Blocked IP from which that bot is pointing my server in .HTACCESS (Order Allow,Deny Deny from 185.191.171.0/24)

After those actions logs from the server are looking as follow: Screenshot 1

Additionally I can see in Google Search Console millions of pages indexed under my domain Screenshot 2

Could you help me to understand what should I do to reduce that unwanted traffic and fix indexing in Google Search Console?

2
  • 1
    Do you know what kind of traffic this is? Who is sending it? In my experience this traffic comes from crawlers which are propably checking for the links which were / are indexed by the malware. You could use an Firewall to block bot traffic. Cloudflare for example offers a free plan where you could do this. It's easy to use and I had great experience with it. However you have to be able to change the nameserver of your domain. Oct 2, 2022 at 10:13
  • Is all the unwanted traffic coming from SemrushBot? If other (normal) users were to access these URLs, what response do they get? Presumably a 404 generated by WordPress? It would be better to return a 410 from Apache instead. However, this doesn't prevent the request from actually reaching your server - after all, the directive you are using to block the request is already sitting on the server. In time the traffic should reduce, but to block that traffic from actually reaching your server you would need to implement an additional (hardware) firewall.
    – MrWhite
    Oct 2, 2022 at 11:27

1 Answer 1

1

If all the traffic is coming from the identified IP's, the solution is to block the IP addresses before the traffic gets to the web server. If you are using a Linux box, This means implementing IPTables rules or null routing those IP's.

You can do this at the command line with a command like

 ip route add 10.10.10.10 dev lo

to do this with the routing table. This will stop the connection from establishing because there is no route back to the host. It will stop the traffic hitting the log server, but is arguably not ideal.

A better way might be to use iptables, which would use a command like

iptables -I INPUT -s 10.10.10.10 -j DROP

This will stop the incoming data even being able to be routed from your system, but there is a very small chance it will not behave as desired depending on your rules and your setup.

Both of these commands need to be done as root and will drop ALL traffic from those IP addresses.

That said, it may be best to just "wait it out" on the assumption that these requests, while annoying in your logs, are not taking up significant resources - and are actively advising visitors those pages don't exist so they can fix their indexing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.