Home / server / Questions / 272182
In Process
dynamic
Asked: 2011-05-22 01:34:04 +0800 CST

DoS Attack from china and other supicious contry

  • 772

My website is under attack. In this last 2 days I have identified and blocked ~20 IPs especially from China (and Taiwan, Malaysia, Egypt, Ireland, Spain and Russia)

This are some of the 20 ips:

95.74.78.55
222.124.156.230
113.108.166.57
125.41.130.120
115.64.76.208
210.5.147.148
117.139.54.192
118.100.12.250
58.251.109.127
61.50.164.157
217.217.131.108
41.236.224.217
151.82.45.148

Is there a way to understand why this is happening and maybe find who is the mandator?

Add

These ip are requesting the same file thousands time/minute. I block one IP after it has made the 250th requests.

ip ddos

5 Answers

  1. If it is really a distributed DoS attack (How do you know? If there are merely connection attempts, it simply could be malware...), it is typically performed through a botnet - exploited and trojanized computers of unknowing people controlled by some third party. There is little chance to find out who's behind this, but if you have more evidence, a larger impact on the availability of your site and maybe a blackmailing letter, you should forward the data to the police.

    • 3

  2. It's happening because you have a system connected to the internet. There may be other causes of course as to why you in particular right now, but you have to understand that dealing with this kind of stuff is simply part of the cost of having an online presence.

    How are you determining they are attacking you? What form does the attack take? At the moment you've given us no information to help you find out if you have a particular problem.

    • 2

  3. Keep blocking the IP addresses like you are already doing. It sounds to me like the attacker targeting your website has pretty limited resources (20 IP's is a very small amount). Your website could be a deliberate target or it could be a random target chosen to test the DoS capabilities of their little network of bots or shells. The attack probably won't last very long, especially if they see that it isn't effective.

    • 1

  4. You can also simply block whole ranges of IPs if you have nothing anyone in china, or taiwan has any business with (eg not a blog but a company website that doesn't do business in china or russia). While it wouldn't stop a full botnet attack, it should help take some pressure off

    • 1

  5. Just block China's subnet with iptables

    • 1