1

Since half february I noticed an increase in traffic to a very small website, which started to mail me an access log daily.

The bot requests the homepage over and over, posting some content in a form with a "3+6=?" verification. At first these messages contained links to other websites. Therefor I decided to block with php all messages containing "href", "http", or "www". This removed the spam for a while, but soon new posts were made with random content like "which university you go to", "i am good", ...

So I added a honeypot, a field that should be empty, which in a few hours was overcome by the bot. Then I added a hidden field with an obfuscated timestamp which manages to keep 99,99% of the posts out. So no more bad data is stored, but the bot still uses the website's resources. The flood consists of thousands of requests, and seems to become more intense over time.

I have found a lot of information which is similar to my problem, but I do not understand how to implement any. How can I prevent this bot from using my website's resources?

Below are an image showing the flood and an excerpt of the access log (in which example.com is actually the website name). These hits are not recorded by google analytics.

Botflood

188.143.232.26 - - [11/Mar/2016:15:01:52 +0100] "POST /index.php HTTP/1.1" 200 7367 "http://www.example.com/index.php?p=Home" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
188.143.232.26 - - [11/Mar/2016:15:01:53 +0100] "POST /index.php HTTP/1.1" 200 7367 "http://www.example.com/index.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
188.143.232.26 - - [11/Mar/2016:15:01:53 +0100] "POST /index.php HTTP/1.1" 200 7162 "http://www.example.com/index.php?p=Home" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
188.143.232.26 - - [11/Mar/2016:15:01:53 +0100] "POST /index.php HTTP/1.1" 200 7152 "http://www.example.com/index.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
188.143.232.70 - - [11/Mar/2016:15:02:02 +0100] "GET /index.php?p=Home HTTP/1.1" 200 6753 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
188.143.232.70 - - [11/Mar/2016:15:02:02 +0100] "POST /index.php HTTP/1.1" 200 7274 "http://www.example.com/index.php?p=Home" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
188.143.232.70 - - [11/Mar/2016:15:02:02 +0100] "POST /index.php HTTP/1.1" 200 7274 "http://www.example.com/index.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
188.143.232.70 - - [11/Mar/2016:15:02:02 +0100] "POST /index.php HTTP/1.1" 200 7212 "http://www.example.com/index.php?p=Home" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
188.143.232.70 - - [11/Mar/2016:15:02:02 +0100] "POST /index.php HTTP/1.1" 200 7212 "http://www.example.com/index.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
188.143.232.70 - - [11/Mar/2016:15:02:02 +0100] "POST /index.php HTTP/1.1" 200 7230 "http://www.example.com/index.php?p=Home" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" 
3
  • What is the web server?? Apache, IIS, or other? In Apache, for example, you can easily use .htaccess to block specific IP addresses or whole IP address blocks. This is your best bet.
    – closetnoc
    Mar 11, 2016 at 17:39
  • @closetnoc as I am using htaccess, i guess Apache. However blocking the IP-adresses is not possible, they change quite a lot ( i already tried)
    – PSZ_Code
    Mar 11, 2016 at 17:43
  • 1
    It is what you have to do. It is a part of business. It is what we all do daily. Check our logs and prevent issues. You can use a tool such as fail2ban or ModSecurity. That is probably the path you should follow. Cheers!!
    – closetnoc
    Mar 11, 2016 at 20:41

1 Answer 1

1

You have a couple of options here that may help:

1) Lock out very old browsers and user agents that don't make sense.

2) Load the form with ajax after JS detects mouse/tap movement and confirms against server side session token.

3) Use a better captcha such as reCaptcha.

4) Use a throttler at a decent rate such as 8-10 requests every 5 secs get blocked for 30.

5) Blacklist every country that you don't need visits from.

6) Blacklist ASN's of top spam hosts/ISP's.

1
  • 3 and 4 would not prevent requesting the resources, right? How would I do 1 and 5? 6 I do not understand. I also tried blocking the ip: "Deny from 188.143.232.", but it does not seem to work (blocking my own IP does work though). Would a CDN like cloudflare be able to solve this?
    – PSZ_Code
    Mar 12, 2016 at 13:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.