Our website is being flooded with thousands of page requests. The access logs looks like this:

**.**.250.*9 - - [24/Oct/2017:09:16:32 -0400] "GET /about-our-company/?screw-you HTTP/1.0" 200 14959 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
**.**.250.*9 - - [24/Oct/2017:09:16:32 -0400] "GET /about-our-company/?screw-you HTTP/1.0" 200 14959 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
**.**.250.*9 - - [24/Oct/2017:09:16:33 -0400] "GET /about-our-company/?screw-you HTTP/1.0" 200 14959 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
**.**.250.*9 - - [24/Oct/2017:09:16:33 -0400] "GET /about-our-company/?screw-you HTTP/1.0" 200 14959 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
**.**.250.*9 - - [24/Oct/2017:09:16:33 -0400] "GET /about-our-company/?screw-you HTTP/1.0" 200 14959 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
**.**.250.*9 - - [24/Oct/2017:09:16:34 -0400] "GET /about-our-company/?screw-you HTTP/1.0" 200 14959 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
**.**.250.*9 - - [24/Oct/2017:09:16:34 -0400] "GET /about-our-company/?screw-you HTTP/1.0" 200 14959 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
**.**.250.*9 - - [24/Oct/2017:09:16:34 -0400] "GET /about-our-company/?screw-you HTTP/1.0" 200 14959 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"

Other than blocking the IPs manually what can we do to stop these attacks?

3 Answers
3

First of all, report whoever is doing it.

You obviously could block anything with a query-string that contains screw-you, but that’ll only help in this case.

Maybe Drop any requests with HTTP/1.0 (browser don’t use it, and “good” bots like google don’t either, but if you need to provide access to special tools, you might not want to do this), but you should keep a close watch over what requests get dropped by this to make sure that you don’t lose any legitimate traffic.

And of course, there are technical solutions that try to automatically discover this kind of traffic and block it. Have a look at CloudFlare, Incapsula, StackPath etc.

Tags:

Leave a Reply

Your email address will not be published. Required fields are marked *