0

I have one small project running on Google Cloud. And during last couple of weeks I notice serious unexpected traffic to it and (a bit surprisingly in 2020-ths) additional bills for it. The volume of traffic is like enter image description here

This is November. I am not seasoned in administration and Unixes so don't know this area and the site is not very important. What I tried:

iftop enter image description here Apache's access.log enter image description here enter image description here What it can be? I understand that hackers can try to find vulnerabilities or guess password. But this doesn't look even as this. What is this? Is there any more or less simple way to block it?

Site's IP is 35.185.230.240

Mikhail M
  • 101
  • 1

1 Answers1

2

Yes, it sounds like hackers trying to scan your application looking for vulnerabilities.

It doesn't mean it's a direct attack. There are many bot and scripts available on the Internet that can scan a range of IPs, domains, and the like. So, your server could just be in that range.

The most important is securing your application. If it's running on a VM, secure your VM by applying hardening techniques and patch management.

There are also additional services that can be used at the ISP border for filtering malicious traffic, like Cloud Armor (on GCP), AWS WAF of even Cloudflare.

Hope that helps

surfingonthenet
  • 695
  • 2
  • 6