1

One of my virtual hosts running Apache is experiencing an influx of over 30,000 IP connections attempting to access non-existent URLs. Here's an example log entry:

62.74.16.240 - - [13/Sep/2023:14:24:46 +0200] "GET /741418kipgo9lrffo7rv2z/ HTTP/1.1" 404 20587 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.36"

These connections primarily originate from countries such as India, Pakistan, Nepal, Bangladesh, among others. I've implemented fail2ban to block these malicious attempts, but they persist relentlessly, rendering the VPS practically unusable.

In an effort to mitigate the issue, I've also employed Cloudflare with the "I am under attack" option. While this approach restores server functionality, it adversely affects our SEO score due to Cloudflare's intermediary position between the server and incoming traffic. Striking a balance between security and maintaining our SEO ranking is now of utmost importance.

Do you have any solutions or experiences to share regarding this issue?

It's indeed frustrating that despite the extensive list of logged IP addresses, there's no straightforward way to contact each respective provider to alert them about their clients unwittingly being used as part of this botnet.

4
  • Cloudflare claims that they let search engine box through their under attack mode without problems. Have you been seeing SEO problems because of it? Sep 13, 2023 at 20:46
  • How are you implementing fail2ban? I am surprised it can't cope. If the IP addresses originate in countries you don't care about, have you considered using GEO blocking - eg linuxconfig.org/…
    – davidgo
    Oct 2, 2023 at 1:39
  • Agree with Davidgo - Found fail2ban very successful with large scale DDOS attacks. And sonething very strainge about a DOS hitting 404 pages (unless of course this is wordpress). Go ask about your fail2ban rules on serverfault (and include specific details)
    – symcbean
    Oct 2, 2023 at 13:12
  • Better addressed on Server Fault: serverfault.com/questions/911008/mitigating-404-bomb-with-nginx Mar 26 at 9:17

1 Answer 1

2

Using CloudFlare is a great way to mitigate attacks. You can look for patterns in the attacks and filter them using CloudFlare's tools. Perhaps a common user agent, IP block, or the target urls they are using. You can even target a whole country for exclusion if you need to.

Another approach is to optimize your 404 response codes. In the log you sent, it sends 20587 bytes (around 20K) response. You can reduce it in htaccess like this:

ErrorDocument 404 "File Not Found"

That will reduce your response to about less than 20 bytes, reducing your server's load (when hit by 30K assaults).

Also, ensure that your server computes 404 pages fast. If there's a bottleneck due to a missing database index for example, it may be taking too long for the server to determine it should reply with a 404, and the attackers are taking advantage of that fact.

There are other things you can try. For instance, setting up a second VPS to act as a load balancer, having separate servers for web and your database, etc. They cost money, but allow you to scale and manage numerous incoming connections.

In general, the "I'm under attack" mode should be used as an emergency and temporary measure, but not as a long term solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.