I noticed strange behaviour on site that I think is some type of attach.
In last few days, traffic on this site jumped 100 times and naturally it spends all assigned bandwidth and gets suspended.
I analyzed http log to try to identify problem and I noticed lots of requests targeting index page on site but using POST method.
That is surely not regular access as site never expects POST on index page. More that that, such request are very frequent and identical except they come very frequently from very spread IP addresses.
Blocking by country would probably do better but Dathorn servers do not offer such option.
Any hints how can I block such attacks. I can use IP block but that would use really large IP list so I would like to avoid that approach. Also I would like to stop it on web server level, before index page is hit, of possible.
Any ideas are welcome.
In last few days, traffic on this site jumped 100 times and naturally it spends all assigned bandwidth and gets suspended.
I analyzed http log to try to identify problem and I noticed lots of requests targeting index page on site but using POST method.
That is surely not regular access as site never expects POST on index page. More that that, such request are very frequent and identical except they come very frequently from very spread IP addresses.
Blocking by country would probably do better but Dathorn servers do not offer such option.
Any hints how can I block such attacks. I can use IP block but that would use really large IP list so I would like to avoid that approach. Also I would like to stop it on web server level, before index page is hit, of possible.
Any ideas are welcome.
Comment