The last few days I noticed some servers being hammered with unknown requests.
Most of them are like the following:
60.246.*.* - - [03/Jan/2015:20:59:16 +0200] "GET /announce.php?info_hash=%80%85%8e%9bu%cfJ.%85%82%e9%25%bf%8e%9e%d7%bf%c5%b0%12&peer_id=-UT3420-v%8bN%aa%60%60%fd%5d%d1%b0Ux&port=15411&uploaded=48588531&downloaded=0&left=0&corrupt=0&key=9E124668&numwant=200&compact=1&no_peer_id=1 HTTP/1.1" 200 -
After a bit of logging and searching I found out that some Chinese ISP (probably CERNET according to the results of whatsmydns.net ) and some Turkish ISP (probably TTNET) respond to dns queries such as a.tracker.thepiratebay.org with various IPs that have nothing to do with piratebay or torrents.
In other words they seem to do some kind of DNS Cache Poisoning for some bizarre reason.
So hundreds (if not thousands) of bittorrent clients on those countries make tons of 'announces' to my webservers which result pretty much in a DDoS attack filling up all Apache's connections.
At the moment I blocked China and Turkey altogether and it does the job, but I would like to find a better way to block those requests.
I was thinking of blocking those requests with mod_security based on the HTTP Host header.
All those requests include an HTTP Host header like a.tracker.thepiratebay.org (or many other subdomains of thepiratebay.org domain).
Here's a dump of the request headers via PHP's $_SERVER variable.
DOCUMENT_ROOT: /usr/local/apache/htdocs
GATEWAY_INTERFACE: CGI/1.1
HTTP_ACCEPT_ENCODING: gzip
HTTP_CONNECTION: Close
HTTP_HOST: a.tracker.thepiratebay.org
HTTP_USER_AGENT: uTorrent/342(109415286)(35702)
PATH: /bin:/usr/bin
QUERY_STRING: info_hash=%80%85%8e%9bu%cfJ.%85%82%e9%25%bf%8e%9e%d7%bf%c5%b0%12&peer_id=-UT3420-v%8bN%aa%60%60%fd%5d%d1%b0Ux&port=15411&uploaded=48588531&downloaded=0&left=0&corrupt=0&key=9E124668&numwant=200&compact=1&no_peer_id=1
REDIRECT_STATUS: 200
REMOTE_ADDR: 60.246.*.*
REMOTE_PORT: 3445
REQUEST_METHOD: GET
REQUEST_URI: /announce.php?info_hash=%80%85%8e%9bu%cfJ.%85%82%e9%25%bf%8e%9e%d7%bf%c5%b0%12&peer_id=-UT3420-v%8bN%aa%60%60%fd%5d%d1%b0Ux&port=15411&uploaded=48588531&downloaded=0&left=0&corrupt=0&key=9E124668&numwant=200&compact=1&no_peer_id=1
SCRIPT_FILENAME: /usr/local/apache/htdocs/announce.php
SCRIPT_NAME: /announce.php
SERVER_ADDR: *.*.*.*
SERVER_ADMIN: *@*.*
SERVER_NAME: a.tracker.thepiratebay.org
SERVER_PORT: 80
SERVER_PROTOCOL: HTTP/1.1
SERVER_SIGNATURE:
SERVER_SOFTWARE: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_perl/2.0.8 Perl/v5.10.1
UNIQUE_ID: VKg8BJBMIPQAD01XYzgAAAAD
PHP_SELF: /announce.php
REQUEST_TIME_FLOAT: 1420311556.43
REQUEST_TIME: 1420311556
argv: Array
argc: 1
So my question is, how can I block incoming requests to Apache based on the request domain (HTTP Host header) ? Keep in mind that the requests are on various URLs not just /announce.php so blocking by URL is not useful.
Also is that approach viable or will it cause too much load and I should keep dropping those requests before they even reach Apache?
Update:
It turns out this issue has affected many people in many countries around the globe.
There have been numerous reports and blogposts about it and various solutions to block this traffic.
I've collected some of the reports to help anyone coming here searching on a solution to block this.
Mysterious misdirected Chinese traffic : How can I find out what DNS server an HTTP request used?
Strange Bittorrent Log On My Server
http://blog.devops.co.il/post/108740168304/torrent-ddos-attack
https://www.webhostingtalk.com/showthread.php?t=1443734
http://torrentfreak.com/zombie-pirate-bay-tracker-fuels-chinese-ddos-attacks-150124/
https://isc.sans.edu/forums/diary/Are+You+Piratebay+thepiratebayorg+Resolving+to+Various+Hosts/19175/
http://furbo.org/2015/01/22/fear-china/
http://www.jwz.org/blog/2015/01/chinese-bittorrent-the-gift-that-keeps-on-giving/
Same issue here. I am using mod_security to block the user-agent
I would change the log to nolog after you verify it is working to avoid filling up your log file
We are experiencing exactly the same issue with one of our client's sites. I added the following near the top of their :
The commented-out RewriteCond can be uncommented to only block a specific user agent. But they have no content at announce or announce.php so we just blocked it all.
I wrote a blog post about how to properly tell BitTorrent clients to go away and never come back, similar to what Dan did, but using nginx.
Torrent trackers (usually) have a standard URL that begins with
/announceor/scrape, so I wouldn't dismiss filtering by URL so quickly. It works.The full post is at - http://dvps.me/ddos-attack-by-torrent
I'm having the same issue at the moment, having torrent trackers point at my server. I've experimented with iptables for the past couple of days and inspected headers and patterns of the requests and narrowed it down to a couple of iptables rules that filters pretty much all of the recent seemingly malicious traffic from Asia (China,Malaysia,Japan and Hong Kong).
Below are the rules. Hope it helps someone.
i took the Chinese ip ranges from: http://www.wizcrafts.net/chinese-blocklist.html and blocked them in my csf firewall, here is the ranges in case you want to copy and paste into your deny ip list of csf: