At my wits end...

For the last several months I have been battling an issue where people are "probing" my site.  All this "probing" is eating up my bandwidth.  The latest episode which occurred 06/06 ate over 500mb in one day.

I am sick an tired of entering individual IP addresses into my htaccess file.  Does anyone have any suggestions that they can provide to ward off the "probes" or what ever they are.

Below is an example of what I am seeing when I look at the latest visitor screen within cpanel. 

Host:208.98.188.79

Http Code: 200 Date: Jun 06 16:14:47 Http Version: HTTP/1.0 Size in Bytes: 18086
Referer: -
Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)

http://gaggleofgosses.us/index.php?id=50&reflect_529_month=7&reflect_529_year=2007&reflect_529_day=false&reflect_529_start=0&reflect_457_month=7&reflect_457_year=2007&reflect_457_day=false&reflect_457_start=0&reflect_229_month=7&reflect_229_year=2007&reflect_229_day=false&reflect_229_start=0&reflect_28_month=http%3A%2F%2Fwww.blankner.ocps.net%2Fmedia%2Fyeloc%2Frepaw%2F&reflect_28_year=2007&reflect_28_day=false&reflect_28_start=0&reflect_875_month=7&reflect_875_year=2007&reflect_875_day=false&reflect_875_start=0&am

These come in at a rate of about 2 a second until all my bandwidth is gone.

Any help would be appreciated.  If I can’t find some way to defense this I am just going to have to uninstall Modx and shut down the domain.

Thanks in advance,

Andy

Quote from: ganeshXL at Jun 07, 2008, 05:03 AM

Apparently, there’s something terribly wrong with your Ditto / Reflect call. Did that page used to work before?

Yes, everything worked/works fine. I updated to the latest version of Modx and any Snippets I had installed to make sure that wasn’t the problem but its still happening.

I have thought that it might be a configuration issue because I don’t here or see any one else complaining about this kind stuff.

I’d hate to band-aid the problem if it is truely something wrong with the way I have done something.

Thanks for the mod_evasive. I’ll look into that.

Andy

I went ahead and unpublished all the blog related pages to see if it was indeed a issue with ditto. I went looking for documentation regarding Ditto and couldn’t find anything that was comprehesive or I felt was current. I guess I’ll just leave them unpublished for now and see what happens over the next couple of days.

Andy

Hello,

The thing about "mod_evasive" is that it works server wide, and most hosting companies already have DDOS protection in place. Too, this would most likely not protect your script from a brute force attack, as the person doing this is proabaly using anon proxies, and has a good list of them, so before you can do anything to stop it, your host will have to suspend your account as I would imagine that it would be using a good deal of resources.

I would try impementing a verification mod, if one is available for this. The DEVS may want to look into adding security to the code to stop the brute force attacks, such as, for example -> x amount of attempts at accessing a feature, page, image...etc within x amount of seconds results in the IP being banned.

Just a suggestion.