Bot Attack Flooding My Website with Requests – Need Advice!

[nefariousn]

hey,

So I'm currently dealing with a pretty intense bot attack on my website, and I'm looking for some advice or suggestions from anyone who's experienced something similar.

Here’s what’s happening:

• The bot is sending 1200-2000 requests per minute, targeting every page and file on our server.
• The attack appears to be coming from a Russian VPS service/host:
  • Hostname: v108037.hosted-by-vdsina.com
  • ASN: 216071
  • ISP: Hosting Technology Ltd
• I've set up Cloudflare's WAF to block the entire IP range since they are using multiple IPs from the same subnet to flood our site with requests.
• I’ve already contacted [email protected] to let them know that someone is using their servers to DDoS us, but no response so far.
• Sometimes the bot will target pages with forms and send 50-100 form fills (around 4-5 form submissions per minute) to the same form, then move on to another form and do the same thing.

Despite blocking ranges with Cloudflare and sending a notice to the hosting provider, the attack continues, and it's really affecting our server performance. Has anyone dealt with something like this before? Are there any additional measures I can take to stop these attacks?

Any help or advice would be much appreciated

 

[derainbow]

That sounds like a tough situation. Since Cloudflare is already in place, you might want to consider implementing rate limiting for specific pages or paths, especially for form submissions. Also, using a service like Fail2ban on your server to block repeated offenders could help mitigate the load. If the attack persists, consider shifting to a CDN that specializes in handling DDoS attacks or using an advanced anti-bot solution like PerimeterX or Imperva to identify and block malicious traffic more effectively.

 

[nefariousn]

That sounds like a tough situation. Since Cloudflare is already in place, you might want to consider implementing rate limiting for specific pages or paths, especially for form submissions. Also, using a service like Fail2ban on your server to block repeated offenders could help mitigate the load. If the attack persists, consider shifting to a CDN that specializes in handling DDoS attacks or using an advanced anti-bot solution like PerimeterX or Imperva to identify and block malicious traffic more effectively.

Regarding rate limiting in clouflare. Im not sure what to set it to. I did 166 every 10 seconds (roughly 1000 requests per minute max) and configured it as follows:

When incoming requests match...
(not cf.bot_management.verified_bot) (as to not block search engine crawlers)

When the rate exceeds:

166 / every 10 seconds

Block for 10 seconds.

Not sure how else I would have CF automatically block traffic that is literally sending 20 requests a second to every page on my site.

 

[cryptom0]

is a wordpress ?
if yes, there are some WordPress addons that can help

1. MalCare free and paid version
2. WP Cerber Security

 

[Bonvi]

Oh wow, I am totally not involved with cybersecurity but who would have thought that DDoS is still a thing

 

[pifxo48t]

Oh wow, I am totally not involved with cybersecurity but who would have thought that DDoS is still a thing

well there is that group, that does not have an username, if you know what i mean

 

[pifxo48t]

hey,

So I'm currently dealing with a pretty intense bot attack on my website, and I'm looking for some advice or suggestions from anyone who's experienced something similar.

Here’s what’s happening:

• The bot is sending 1200-2000 requests per minute, targeting every page and file on our server.
• The attack appears to be coming from a Russian VPS service/host:
  • Hostname: v108037.hosted-by-vdsina.com
  • ASN: 216071
  • ISP: Hosting Technology Ltd
• I've set up Cloudflare's WAF to block the entire IP range since they are using multiple IPs from the same subnet to flood our site with requests.
• I’ve already contacted [email protected] to let them know that someone is using their servers to DDoS us, but no response so far.
• Sometimes the bot will target pages with forms and send 50-100 form fills (around 4-5 form submissions per minute) to the same form, then move on to another form and do the same thing.

Despite blocking ranges with Cloudflare and sending a notice to the hosting provider, the attack continues, and it's really affecting our server performance. Has anyone dealt with something like this before? Are there any additional measures I can take to stop these attacks?

Any help or advice would be much appreciated

PerimeterX or Imperva could provide more robust defense

 

[RSlade]

Hey, hopefully, I can help you out a little bit.

I wrote my own script. With this, you'll need to register with https://proxycheck.io/ and get an API key. The key is free and will block 1000 requests a day. Place your API key where it says "YOUR_KEY_HERE" in the part of

'?key=YOUR_KEY_HERE&vpn=1&asn=1';

This can be implemented in either your functions.php or a code snippet plugin.

This is configured for Cloudflare but should work just fine for those not using Cloudflare.

Here is the code for it: https://github.com/RyNite/Bot-Attack/blob/main/Bot

FYI: Ive never used Github before so let me know if you have problems accessing it.

For me, this significantly lowered the request rate (I still had to pay for a 40k daily API key because I was getting hit hard (pissed off some folks in Nigeria)) and increased the speed of the site because it's only using one request per IP that connects.

this code still allows bots for SEOs (something with proxychecker.io blocks it, idk why) and added a self-cleanup so it doesn't fill the database up.

 

[Steptoe]

• Sometimes the bot will target pages with forms and send 50-100 form fills (around 4-5 form submissions per minute) to the same form, then move on to another form and do the same thing.

Can you put captchas on those forms, even temporarily? Something more involved/expensive for captcha solvers like hcaptcha or funcaptcha might stop them from using that attack vector.

 

[cve47]

to handle captcha issues you can either activate rate limiting through Cloudflare or implement a honeypot anti-bot plugin to block unwanted submissions

Set up Fail2Ban on your server for extra security juice

also consider rate-limiting access to files like sitemap.xml and robots.txt (if they are getting touched, ddos attacks i usually receive target these ) i think due to their small size.

 

[Bottom_Line]

You can try to set more specific rules to block based on the attach patterns, or specific URL's that is being targeted, and make sure you have robust backup system to prevent the site's misfunction.

 

[Turbo B.]

https://github.com/mitchellkrogza/apache-ultimate-bad-bot-blocker
https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker

 

[Nikolaos]

hey,

So I'm currently dealing with a pretty intense bot attack on my website, and I'm looking for some advice or suggestions from anyone who's experienced something similar.

Here’s what’s happening:

• The bot is sending 1200-2000 requests per minute, targeting every page and file on our server.
• The attack appears to be coming from a Russian VPS service/host:
  • Hostname: v108037.hosted-by-vdsina.com
  • ASN: 216071
  • ISP: Hosting Technology Ltd
• I've set up Cloudflare's WAF to block the entire IP range since they are using multiple IPs from the same subnet to flood our site with requests.
• I’ve already contacted [email protected] to let them know that someone is using their servers to DDoS us, but no response so far.
• Sometimes the bot will target pages with forms and send 50-100 form fills (around 4-5 form submissions per minute) to the same form, then move on to another form and do the same thing.

Despite blocking ranges with Cloudflare and sending a notice to the hosting provider, the attack continues, and it's really affecting our server performance. Has anyone dealt with something like this before? Are there any additional measures I can take to stop these attacks?

Any help or advice would be much appreciated

PerimeterX and imperva could help you out a lot.