HELP! Website is under attack...

  • Thread starter Thread starter Deleted member 752298
  • Start date Start date
Status
Not open for further replies.
D

Deleted member 752298

Guest
DDOS attacks should be known to you guys, but this one, is killing my entire server.

qYUMseX


What I have done?
  1. Activated CloudFlare and 'I am under attack mode'.
  2. Restarted server, but keeps getting 503 server error.
How am I able to stabilize this?
 
Advertise on BHW
Block the traffic from that country or IP range for sometime
 
As Baby said, blocking specific IP ranges might help. Weird that Cloudflare was not able to stop the attack though. Are you sure all traffic is coming through the CDN or did you expose your real IP somewhere and they might be hitting your system directly?
 
Nonilol said:
As Baby said, blocking specific IP ranges might help. Weird that your Cloudflare was not able to stop the attack though. Are you sure all traffic is coming through the CDN or did you expose your real IP somewhere and they might be hitting your system directly?
Click to expand...

CF has been activated recently - after I noticed the DDOS attack when I woke up.
The REAL IP can be exposed - waiting for the host's their reply on this.
 
Veil123 said:
Disable Cloudflare and pay for StackPath/MaxCDN and filter the attackers' countries
Click to expand...

What has StackPath / CDN to do with DDOS attacks, or am I missing a feature?

BTW getting this error:

PHP Warning: PHP Startup: Unable to load dynamic library 'newrelic.so' (tried: /opt/alt/php74/usr/lib64/php/modules/newrelic.so (/opt/alt/php74/usr/lib64/php/modules/newrelic.so: cannot open shared object file: No such file or directory), /opt/alt/php74/usr/lib64/php/modules/newrelic.so.so (/opt/alt/php74/usr/lib64/php/modules/newrelic.so.so: cannot open shared object file: No such file or directory)) in Unknown on line 0
 
You need to switch hosting. Somewhere where this kind of attack can be mitigated. Look into buyvm. They offer 500+ gigabit protection. Ive been using them for years.
 
elocin said:
You need to switch hosting. Somewhere where this kind of attack can be mitigated. Look into buyvm. They offer 500+ gigabit protection. Ive been using them for years.
Click to expand...
He is using Closte which is known for their high security
 
You got access to csf firewall or anything like that? You want to make sure you can add new block lists to your IP... add that and then reboot apache (after you taken a backup) sounds like some has gotten access to something
 
Festinger said:
CF has been activated recently - after I noticed the DDOS attack when I woke up.
The REAL IP can be exposed - waiting for the host's their reply on this.
Click to expand...
Once they know your origin IP address - and given they attack it - I don't think Cloudflare can do anything for you out of the box. I would check back with your webhost whether they got any solutions for it. In the end it comes down to blocking IPs and balancing load. GCS and AWS have strong ddos protection services that you can book if you host with them. Don't know how smaller webhosts handel such incidents, but I'd definitely give contacting them a shot.
 
Nonilol said:
Once they know your origin IP address - and given they attack it - I don't think Cloudflare can do anything for you out of the box. I would check back with your webhost whether they got any solutions for it. In the end it comes down to blocking IPs and balancing load. GCS and AWS have strong ddos protection services that you can book if you host with them. But make sure to contact your host.
Click to expand...

This is exactly the case, they have targetted the server IP - so CF is not usable in this matter.
I contacted the host.
 
Oh another thought... have you just updated to php 7? from 5? At all.. wondering if it is an attack and if it's more of a case of new relic is corrupt and trying to install / update but can't
 
Festinger said:
DDOS attacks should be known to you guys, but this one, is killing my entire server.

qYUMseX


What I have done?
  1. Activated CloudFlare and 'I am under attack mode'.
  2. Restarted server, but keeps getting 503 server error.
How am I able to stabilize this?
Click to expand...

This looks like they are only attacking a specific file during your page load which cross-referenced to load content from somewhere else or you didn't paid Cloudflare enough for them to shield it... Try checking for the apache/webserver logs to find that link. I've sent you a message.
 
Advertise on BHW
Status
Not open for further replies.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top