How to prevent repeated ddos attacks by competitor?

A competitor is resorting to frequent ddos attacks that shut down my host's server several times a week. He has already managed to force two other competitors to shut down permanently, because they didn't want to deal with the ongoing problem (and they don't realize there are solutions, i'm guessing). I am currently on shared web hosting and am considering VPS but am unsure this could or would solve the ddos problem. I am also considering a cloudserver but again, i'm not sure this would prevent ddos. It's a Wordpress blog and it's a tight niche and doesn't get all that much REAL traffic, so bandwidth isn't necessarily a challenge right now. In the future, i'd like to add a forum, so the bandwidth demands may increase, as well as the disk space needed to carry the forum. My questions include: how do I prevent ddos? What is the best option to prevent ddos and possibly increase diskspace and bandwidth demands in the near future?

Well, bad story budy! I've been learning about hacking so far (just for personal study purpose only). Base on my knowlege - you have no way to prevent DDOS if your competitor tries to do that by an unethical business.Change your DNS (of course may not or depend on what your choice) is the best solution (till now I've learned). P/S: Plz Google for Cloudflare + Dome9. This also is great way for u to go. If you can't figure out how to do, then I will share more here. I know this way but haven't used it yet actually.

You could try looking from where the source of attacks is coming from and then filter out that country.

JaxMan said:

A competitor is resorting to frequent ddos attacks that shut down my host's server several times a week. He has already managed to force two other competitors to shut down permanently, because they didn't want to deal with the ongoing problem (and they don't realize there are solutions, i'm guessing).

Click to expand...

This is a golden opportunity. If you stay standing you could get far more traffic and sales inthe long run!

JaxMan said:

I am currently on shared web hosting and am considering VPS but am unsure this could or would solve the ddos problem. I am also considering a cloudserver but again, i'm not sure this would prevent ddos.

Click to expand...

Moving to a VPS and minimizing the load (Pictures, script and database calls) is a great idea anyway and helps the site become a bit stronger. Would defo be on my to do list.

JaxMan said:

ow do I prevent ddos?

Click to expand...

Scan your server logs. Look for common IP address ranges and block them. Look for clues as to what person / company is behind it all. Make your website stronger and more able to withstand future attacks.

One common denominator with all the attacks i've fought off is that they ALWAYS make a mistake! It's important to know that most "hackers" are basically uneducated script kiddies who don't understand basic computer science let alone what the tools they use actually do!

If you search the logs and correlate everything i'm 99% certain you'll probably find a fellow competitor.

I wouldn't advise fighting back with fire though. IMHO that just flames the guy and he'll double his efforts to take you down. Just focus on becoming strong, understanding the person doing it, sussing out their resources / capabilities and making sure you have your bases in order.

JaxMan said:

What is the best option to prevent ddos and possibly increase diskspace and bandwidth demands in the near future?

Click to expand...

Cloud or VPS basically. Choose something with unlimited bandwitch though! One of the ways Ddos works is by eating your bandwidth and leaving you with a huge bill, potentially putting you out of business. Go with unlimited and the worst that can happen is you get booted off for fair usage, a pain in the arse but better than a huge bill.

If you want someone to look at your logs just shout

Look into getting a mitigation network if you have the cash.
Prolexic is good.

Filter all RFC-1918
http://www.ietf.org/rfc/rfc1918.txt

Filter some more
http://www.ietf.org/rfc/rfc2267.txt

Most likely he's using Trinoo, TFN or Stacheldraht. Learn how these programs operate.
Some default ports:

1524 tcp
27665 tcp
27444 udp

Don't let him win.

Hello,

You can find some shared host with DDOS protection but i most i known are more expensive than VPS service.

We have DDOS protected VPS.
However please not (and that's apply to all DDOS provider), migitation will work but you could still get partial attack (like 99% filter 1% remain). In some case you server won't be down but the 100/200 Mbps of the unfilter attack can saturated your server.

We have customer with cheap VPS (means $8.65/mo) having DDOS and service is unfacted with a 20 gbps attacks and some with 5 Gbps seems to have issue.
the only solution is to customize the DDOS protection for filter faster/better/differently the attack and it's could be very costly

We saw some customer starting having small attack 2-3 Gbps when they switch to us. After some days, the attack going more strong since DDOS protection work. Seems many give up as DDOS may cost more for start affect the VPS (or not affect it at all)

If he does ddos like a pro you can't, at least for any sane amount of money. But tbh I don't think he is really pro.
You may try to use CloudFlare ddos protection, it is not too expensive and see if this would work for you. Don't try to stop ddos yourself unless you're really familiar with linux and its' toold.

Find common IP addresses and reflect back with an amplified DNS to port 53 on those IPs. Whoever the host is will block that attack and find the source.

Regarding Cloudflare as said @Bartholomew could be a good solution if you hide your ip correctly. Don't sure direct.domain.com or same ip for MX.

If it's a newbie it's will be maybe enough.

cloudflare + firewall + antiddos hosting

Another plus one for cloudflare. I do believe they have a free version but I am not sure if it includes DDOS
protection. However it will help you block different ip ranges where the attacks are coming from.

-RK

DDOS, or DNS flood? Have a close look at your logs... if it's a DNS flood, you can block it relatively simply just using CloudFlare, and even if it's a 'weak' DDOS attack you can block it with CloudFlare (just be aware they can be arrogant a$$holes to deal with - looking for an alternative may be a good idea too).

What sort of volume of traffic do you get during an attack? >10gbps? >50gbpb? >100gbps?

Suggestions for antiddos hosting? I need DCMA ignored.

iglow said:

cloudflare + firewall + antiddos hosting

Click to expand...

Hostwinds just had a DDOS attacks & is offering a dedicated IP Address
for 50% off for a $1

Should I get it it sounds like a good deal & what are the benefits for
having a dedicated IP Address my marketing will be on sites like
Facebook,Youtube & Pinterest.

cpacashman said:

Hostwinds just had a DDOS attacks & is offering a dedicated IP Address
for 50% off for a $1

Should I get it it sounds like a good deal & what are the benefits for
having a dedicated IP Address my marketing will be on sites like
Facebook,Youtube & Pinterest.

Click to expand...

Well won't solved all problems, if they don't have anti-DDOS protection.

Basically network without Anti-DDOS protection will nulled route the target IP.
That's means that's the attack to target IP won't reach anymore the switch and the server and all data connexion is now stop at the router.

So if the datacenter nulled route the DDOS IP, server won't be affected anymore, but that's ip will be unreable. Some datacenter auto block, some others with do manually. In "best" scenario, auto nulled routing, there will be a downtime to all customers on the same server (an maybe closest customer or even big part of datacenter for very big attack), and get unique ip won't change the issue.
However when the DDOS IP is nulled routed, quality or service will be back to others IP and server as well.

The only case where they won't be a downtime is when the DDOS is small.

When you choose a hosting with Anti-DDOS, and if you are targetted by the attacks, nobody except you can be affected.
The result of the attack on your server much depend of the speed of your VPS, type of the attack, quantity and application target.
However nobody on the server will be affect by the attack.

Hope that's help to understand better the difference.

do what bhw does and use cloudflare.

Numbuh362 said:

do what bhw does and use cloudflare.

Click to expand...

cloudflare is a good free solution but don't protect VPS, it's protected only webserver

VPS won't do much good. A good DDoS protected hosting + Cloudflare should helpful. If you're still getting attacks then try Cpatcha DDoS protected hosting.

Free cloudflare will have a tough time stopping a real ddos from a savvy attacker.
As others mentioned you need a vps with good ddos protection. Some limit to 10 or 11 Gbs attacks, others go further.
In some situations using nginx may help...
Best of luck!