2

So I'm getting this on my Apache log on a small server for a local company:

1.2.3.4 - - [09/Nov/2015:17:00:16 +0000] "GET /wp-content/uploads/2012/08/gold-coins.jpeg HTTP/1.1" 301 342

about 500,000 times per day with 150,000 unique IP's. I've redirected that traffic outside my site (hence the 301) because it was crashing the server. But it is still using some bandwidth. What is the best way to remedy this situation?

user321255
  • 21
  • 2
  • no one reports attacks to providers... as long every body won't care about it, it will stay like that. You can do like me reporting thoose ip to providers, here the link to find abuse email of ip providers : http://www.abuse.net/. By the way to redirect them request on CIA server ;) – Froggiz Nov 09 '15 at 17:52
  • 1
    I would serve them a 1GB file... (note: only with nginx, because that doesn't cost a worker. Apache will be DOSed then...) – Halfgaar Nov 09 '15 at 18:11
  • Redirect them to a picture of goatse or tubgirl. – Sammitch Nov 09 '15 at 19:36
  • the best thing is to create a rule on your router, like that trafic will be reduced – Froggiz Nov 09 '15 at 19:47
  • 3
    Add the referrer to your log, and see who's sending traffic to you. Then tell them to stop. – Gordon Davisson Nov 10 '15 at 03:06

2 Answers2

3

This issue is called image hotlinking.

Nginx can be configured in a variety of ways to protect you from it. Read it about it here:

http://www.htpcbeginner.com/image-hotlink-protection-nginx/

http://nginxlibrary.com/hotlink-protection/

http://nodotcom.org/nginx-image-hotlink-rewrite.html

Trouble in Nginx hotlink protection

As you are saying some 150K IPs hit it 500K times, that means about 3 times each. With that in mind, you can also add browser caching of such static jpeg files in the mix, to avoid 66% of the requests. Serving static files from a so-called cookieless domain saves another bit.

Another route to consider is banning IPs at the firewall level, for example with the help of Fail2Ban. If you ban each after the first download of that file, it saves you 66% of the requests. Because it never reaches your webserver, this saves a lot of resources. But this doesn't stop it at the source.

Referrer based hotlink protection is ideal, and when you keep a list of such referrers, you can ask them to stop hotlinking so the issue hopefully goes away after a while.

Community
  • 1
JayMcTee
  • 3,763
  • 12
  • 20
0

In apache you can stop hotlinking quite easily:

https://wiki.apache.org/httpd/DisableImageHotLinking

natxo asenjo
  • 5,641
  • 2
  • 25
  • 27