0

Recently, one of my servers came under attack by DDoSing it. After inspection of access logs, I can only find one common denominator: Referrer.

All of request come with (I assume) fake referrer:

Obviously, all of these are legitimate websites, so I was wondering what would sound strategy against those?

I read an article about a similar attack:

https://www.qurium.org/alerts/colombia/la-nueva-prensa-attacked-for-operacion-jaque-documentary/

Jovan Perovic
  • 123
  • 4
  • 1
    A sound strategy for what, exactly? What was the traffic doing? Was it just high bandwidth? Have you considered a DDoS mitigation service? – schroeder Oct 21 '20 at 20:33
  • Just running GET requests again index page. Request size varies between 100 and 500b, so the high bandwidth does not seem to be the target. As for the DDoS protection, we cannot do that due to a funky DNS configuration that is way beyond our jurisdiction :(. We hit the wall with Cloudflare last week when we attempted to set it up :( – Jovan Perovic Oct 21 '20 at 21:49
  • I was thinking about blocking requests by Referrer, but that sounds too risky of hitting legitimate visitors, right? – Jovan Perovic Oct 21 '20 at 21:50
  • @JovanPerovic if the traffic isn't coming from a real browser, the referrer header can be nonpresent or set to whatever they want. – multithr3at3d Oct 22 '20 at 02:46
  • @multithr3at3d Either they are masking it very well or user agents seem totally legitimate. So far everything points in a direction of an infected botnet... – Jovan Perovic Oct 22 '20 at 11:20

0 Answers0