DDOS attack

feysal

feysal

Power Member
Joined
Jul 29, 2010
Messages
649
Reaction score
248
First of all, please apologise my bad english.

I would lile to ask you guys about ddos attack. Last few days i am getting warning from cloudways that my cpu resources exceed limit. My site is currently host at Linode.

After checking with cloudways support they agreed that my site has been attack. So i decide to scale up my server. From 1gb to 2gb. Unfortunately, the attack getting bigger so end up my site getting 502 error sometimes.

So, i tried to use free cloudflare. But it doesnt resolve the issue. Then i finally decide to sign in for Pro plan for $20. After a while my site still getting attack and it slow down my website.

Finally i scale up my server again up to 4gb. But yet the attack getting bigger and i am getting warning due to resources limit.

I am looking for something like sucuri Firewall. But i thought its not something to do with my competitor. How come he/she now that i am scalling up my server? Maybe someone attacking Linode server or maybe something else?

I am thinking to move to another cloud server within 24 hours. Let me know what you guys think?
 
Advertise on BHW
Are the DDOS attacks coming from a specific country? Can you block the server from accepting connections from that country?
 
Nope. It comes from everywhere in the world.
 
You need to change your server IP, you will need to contact your hosting. Because the attacker already knows it and is attacking it directly. So it’s compleitly pointless. Once you change the ip it should work, because they will see cloudflare as the new ip and won’t know the new direct server ip. Make sure you change it on your cloudflare DNS settings and also that your email records (if you are using) are not leaking your server real ip. Make sure proxing is also enabled. (Colored orange)
 
TiagoS said:
You need to change your server IP, you will need to contact your hosting. Because the attacker already knows it and is attacking it directly. So it’s compleitly pointless. Once you change the ip it should work, because they will see cloudflare as the new ip and won’t know the new direct server ip. Make sure you change it on your cloudflare DNS settings and also that your email records (if you are using) are not leaking your server real ip. Make sure proxing is also enabled. (Colored orange)
Click to expand...

Makes sense. Thanks bro.
 
I've migrate to Vultr to test if it has something to do with old server. If it is still happening. I will change the server again, and together with firewall this time as per what @TiagoS suggestion.
 
TiagoS said:
You need to change your server IP, you will need to contact your hosting. Because the attacker already knows it and is attacking it directly. So it’s compleitly pointless. Once you change the ip it should work, because they will see cloudflare as the new ip and won’t know the new direct server ip. Make sure you change it on your cloudflare DNS settings and also that your email records (if you are using) are not leaking your server real ip. Make sure proxing is also enabled. (Colored orange)
Click to expand...

It's so easy to bypass cloudflare and get the ip. Takes less than 30 seconds. There are even websites that do this work for you so cloudflare does not "hide" your ip to a hacker.. only to people like you it seems to be hidden
 
feysal said:
I've migrate to Vultr to test if it has something to do with old server. If it is still happening. I will change the server again, and together with firewall this time as per what @TiagoS suggestion.
Click to expand...

Vultr have ddos protection, if I remember correctly it costs about 5 or 10 dollars for extra security.
 
A7strohhut said:
It's so easy to bypass cloudflare and get the ip. Takes less than 30 seconds. There are even websites that do this work for you so cloudflare does not "hide" your ip to a hacker.. only to people like you it seems to be hidden
Click to expand...

How about trying to solve the problem instead of being a smartass?
 
Koddos servers might be of help, they are good with ddos attacks.
 
A7strohhut said:
It's so easy to bypass cloudflare and get the ip. Takes less than 30 seconds. There are even websites that do this work for you so cloudflare does not "hide" your ip to a hacker.. only to people like you it seems to be hidden
Click to expand...
Yes it does if you do it properly, otherwise it would be pointless. But you need to erase the traces, and not leak it with MX, past dns records. If you setup properly it’s almost impossible to be found. Do you really think countless big sites would be paying for their mitigation if it was that easy? Go search for the methods of finding the real ip and see that all can be patched if you know what you are doing

https://support.cloudflare.com/hc/e...posing-your-origin-IP-address-via-DNS-records
 
feysal said:
I've migrate to Vultr to test if it has something to do with old server. If it is still happening. I will change the server again, and together with firewall this time as per what @TiagoS suggestion.
Click to expand...
You need to do it properly, because by the time you changed they might have already figured. Contact cloudflare, pretty sure they can advise you.
 
Getting a Sucuri Firewall would help a bit since it has DDOS protection, although there's a few things to consider.

First of all, have you actually confirmed you have a DDOS attack? There's a lot of reasons your CPU can max out, and DDOS is only one of them. I'd start by confirming that you're actually seeing DDOS traffic first otherwise the problem might be with a plugin on your site or something.

If it is indeed a DDOS attack, then changing your Hosting IP and getting a hosting server that has DDOS protection would be wise.
 
Try using a VPS at OVH. The prices are very reasonable and it has a built in DDOS shield. The DDOS protection works pretty well and has mitigated many attacks against my site. There are probably other options like OVH for the mitigation protection, but I know it works and prices are good so check it out.

feysal said:
First of all, please apologise my bad english.

I would lile to ask you guys about ddos attack. Last few days i am getting warning from cloudways that my cpu resources exceed limit. My site is currently host at Linode.

After checking with cloudways support they agreed that my site has been attack. So i decide to scale up my server. From 1gb to 2gb. Unfortunately, the attack getting bigger so end up my site getting 502 error sometimes.

So, i tried to use free cloudflare. But it doesnt resolve the issue. Then i finally decide to sign in for Pro plan for $20. After a while my site still getting attack and it slow down my website.

Finally i scale up my server again up to 4gb. But yet the attack getting bigger and i am getting warning due to resources limit.

I am looking for something like sucuri Firewall. But i thought its not something to do with my competitor. How come he/she now that i am scalling up my server? Maybe someone attacking Linode server or maybe something else?

I am thinking to move to another cloud server within 24 hours. Let me know what you guys think?
Click to expand...
 
Well. After being on Vultr for a few days. I cannot see the attack anymore. So the probelm is not from any plugin or script from my wordpress. I hope the problem will no longer appear.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top