We see some bad IP addresses that will ping us say 2-5 times a second for HOURS, trying to find a vulnerability. For example, it will in the same second send POST requests to uuu.php, sss.php, 1.php, 2.php, core.php, qaz.php, core.php, sha.php, ppx.php, config.php, config1.php. Basically throwing the kitchen sink at our server.
Or maybe this is a DDoS attack that is just trying to overwhelm our server with meaningless requests?
How do we block these requests?
It has been going on for days and Cloudflare does not block it.
One option we’ve considered is setting a WAF rule (we have the Enterprise plan) to block any visitor who sends requests more than say 3x in a second. If so, is there an easy way to still allow legitimate search indexing from Google, Bing and Yahoo?
1 Like
sandro
November 7, 2018, 12:53pm
2
Can you post a few server log entries of those requests?
Yes. Here is a sample from our server log.
119.27.166.152 - - [06/Nov/2018:05:44:53 -0500] “PROPFIND / HTTP/1.1” 301 531 “-” “-”query.php HTTP/1.1" 301 587 “-” “Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0)” __.init.php HTTP/1.1” 301 633 “-” “Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0)”
You can just block that IP or AS45090 If you don’t do business in China.
sandro
November 7, 2018, 4:49pm
5
In this case I’d simply block that specific IP address.
Thanks for the advice!
Yes, we’ve now blocked that IP address.
We’ve also blocked all traffic from China and India.
But the IP addresses doing similar attacks change day-to-day.
For instance today it is 2605:9880:400:68:225:90ff:fe47:aadc. That’s in Florida in the US. Another is 172.56.22.180 in Washington State in the US.
Does Cloudflare have an automated way of recognizing these sort of attacks, no matter which IP address, and blocking them? Otherwise we have to recognize that our server is slow, then search our server access logs, then block them in Cloudflare. It’s like it’s 1999.
sandro
November 7, 2018, 5:07pm
8
In that case an IP or country block is relatively pointless.
Alternatively you could block by user agent for example. In this case neither Firefox 31 nor IE 8 are really common anymore.
1 Like
Agreed and also with the OP of blocking after x amount of 404s
How do you set up a rule in Cloudflare to block after x number of 404s? The 404s are given by our server, not Cloudflare. How would Cloudflare know that our server is returning 404s?
That would have to be a server side firewall.
system
December 7, 2018, 12:50pm
12
This topic was automatically closed after 30 days. New replies are no longer allowed.