How to deal with a DoS attack?

[ePrime]

One of my domains had a DoS attack but my hosting company blocked all the domains in my account. Is that normal?

Is it possible to check details like IP addresses involved in the attack in the cPanel?

 

[BHSEONewb]

You'd likely need to look at your site's firewall logs, or the logs of the hosting provider (which they most likely won't send you).

 

[Deleted member 15724]

Cloudflare has some services to deal with this. If you're on a shared server, all domains on that server will suffer from the attack, even other customers.

 

[bhavik85]

If you are using wordpress then there are some firewall plugins.

e.g. Wordfence Security and/or All In One WP Security & Firewall.

Plus add your site to Cloudflare which will block excess traffic (DDOS) from other networks. Combining these things will 100% stop DDOS attacks..

 

[CyberHour]

Since you are already under DDOS.. even IF you go behind CF without changing the root IP nothing will change..
The person who is attacking you know your IP already and so CF will do nothing.

Change IP, go behind CF and apply the WP recommended above plugins.

 

[danforth]

Newer use Wordpress plugins to protect from DDoS. Protection must be applied on the lowest networking layer, not on the 7 layer of OSI model.

The best solution is change IP and use CloudFlare, it will be enough. If it's kiddy DDoS also firewall could help (iptables, ufw, netfilter).

 

[Area 51 Man]

DDoS's protection service is your solution, bro. You should take a look. I hope you are not attacked again. Good luck.

Best regards.

 

[pravinlpatel]

CloudFlare is way to go. Firewall logs is best to check but if you are using shared hosting then it's bit tricky and you depends on hosting provider to tackle challenge.

However, horizontal scaling from cloud provider like AWS and using multiple security layer, your infrastructure can absorb DdoS.

By the way what you will do with that IP address? Be informed that DdOS is usually come from thousands and millions of of IP address and not from single ip addresa.

 

[VEXPA]

Best option if you have a little bit knowledge of Linux, you can rent server from DigitalOcean, turn on Cloudflare protection (e.g. with Captcha) - they have many options.

Actually need understand if it is DOS or DDoS attack.

DOS - tries to interrupt your website and use all of your parameters such as RAM, CPU, IO (if hosting use CloudLinux OS)
DDoS - tried to interrupt hosting server network or all datacenter, so its normal when hosting providers block your account and forward traffic to nullroute (127.0.0.1)

 

[virtualbyron]

It happened to me a few years ago; I recommend that you use sucurinet if you have budget or cloudflare.
Then change your server, because if they already know the IP they will be able to DDOS

 

[VEXPA]

It happened to me a few years ago; I recommend that you use sucurinet if you have budget or cloudflare.
Then change your server, because if they already know the IP they will be able to DDOS

Then best option is to have server with DDoS protection and + Cloudflare on top. I did some of these solutions before.

 

[virtualbyron]

Then best option is to have server with DDoS protection and + Cloudflare on top. I did some of these solutions before.

My OVH server was guaranteed DDOS protected, but it was bullshit.
Yes, your best option is hiding your IP address with cloudflare, sucurinet or other similar services, whatever the server.

But if they already know your IP address it's too late; you have to move your files in another server.

 

[VEXPA]

My OVH server was guaranteed DDOS protected, but it was bullshit.
Yes, your best option is hiding your IP address with cloudflare, sucurinet or other similar services, whatever the server.

But if they already know your IP address it's too late; you have to move your files in another server.

Yeah I know OVH is not best solution. I did GRE tunnel in my private DC with DDoS protection companies in HK/UK to protect clients. Protection up to 250 Gbps, one time we got 180 Gbps attack and everything was OK. The only one disadvantage of my solution, that server/IP has only 40 Mbps of speed for up/down (if need more need increase channel speed and pay extra $), but advantage is that protection is 24/7/365 on. While other competitors give solution "on-demand" it is budget service - it means when attack comes, they disconnect their network and start filtering traffic through partners/GRE tunnels, so you have minimum 5 mins downtime... Anyway there are a lot of different solutions...

also before was Cloudflare "decoder" to find server IP. I do not know if it still exist.