Need 3Gbps ddos protection.

Scorp

Well-known member

Trusted Uploader

May 12, 2019

572

888

93

Earth, Universe.

www.servebabiato.tk

• May 13, 2021

• #1

Currently my sites are facing ddos attack between 2Gbps and 4 Gbps .
Cloudflare pro plan is unable to mitigate it.
Any other services like ddos-guard.net.
Any solution from your side will be accepted.

 

DJJigsaw

Active member

Nov 10, 2020

255

137

43

• May 13, 2021

• #2

does your current host have firewalls in place?

 

Scorp

Well-known member

Trusted Uploader

May 12, 2019

572

888

93

Earth, Universe.

www.servebabiato.tk

• May 13, 2021

• #3

DJJigsaw said:

does your current host have firewalls in place?

Click to expand...

No but am totally depended on my website and cloudflare firewall:
Screenshot 1: https://prnt.sc/12wlmft
Screenshot 2: https://prnt.sc/12wlnm7

 

G

guayaba

New member

Jul 17, 2018

7

1

3

• May 13, 2021

• #4

Scorp said:

Currently my sites are facing ddos attack between 2Gbps and 4 Gbps .
Cloudflare pro plan is unable to mitigate it.
Any other services like ddos-guard.net.
Any solution from your side will be accepted.

Click to expand...

Are you auditing what's happening so you can properly set the rules on CF?

 

Scorp

Well-known member

Trusted Uploader

May 12, 2019

572

888

93

Earth, Universe.

www.servebabiato.tk

• May 13, 2021

• #5

guayaba said:

Are you auditing what's happening so you can properly set the rules on CF?

Click to expand...

Can you tell me how to audit?

 

G

guayaba

New member

Jul 17, 2018

7

1

3

• May 13, 2021

• #6

Scorp said:

Can you tell me how to audit?

Click to expand...

Well, considering we don't have any info about how do you host this... But first thing will be coollecting the logs of the DDoS and check what they are targeting. Based on that just deploy the proper rules on CF

 

Scorp

Well-known member

Trusted Uploader

May 12, 2019

572

888

93

Earth, Universe.

www.servebabiato.tk

• May 13, 2021

• #7

guayaba said:

Well, considering we don't have any info about how do you host this... But first thing will be coollecting the logs of the DDoS and check what they are targeting. Based on that just deploy the proper rules on CF

Click to expand...

Thanks give me some time, will tell you.

 

biscuit

Well-known member

May 30, 2018

417

240

63

• May 13, 2021

• #8

Are the screen shots your ddos attack? Looks like normal traffic.

 

SpiderWeb

Active member

Trusted Uploader

Sep 23, 2020

183

166

43

• May 13, 2021

• #9

Scorp said:

Thanks give me some time, will tell you.

Click to expand...

Which os, panel are u using...

 

adderall

Well-known member

Babiato Lover

GiveAway Master

Trusted Seller

Trusted Uploader

Mar 24, 2020

800

1,211

100

36

USA, Illinois

litemere.org

• May 13, 2021

• #10

Scorp said:

Currently my sites are facing ddos attack between 2Gbps and 4 Gbps .
Cloudflare pro plan is unable to mitigate it.
Any other services like ddos-guard.net.
Any solution from your side will be accepted.

Click to expand...

@Scorp

Try using Microsoft's Azure Front Door, it is most excellent!

 

Scorp

Well-known member

Trusted Uploader

May 12, 2019

572

888

93

Earth, Universe.

www.servebabiato.tk

• May 13, 2021

• #11

gopo said:

Are the screen shots your ddos attack? Looks like normal traffic.

Click to expand...

no. Normal traffic don't consume that much

 

Scorp

Well-known member

Trusted Uploader

May 12, 2019

572

888

93

Earth, Universe.

www.servebabiato.tk

• May 13, 2021

• #12

SpiderWeb said:

Which os, panel are u using...

Click to expand...

cpanel. My hosting has ngnix

 

Scorp

Well-known member

Trusted Uploader

May 12, 2019

572

888

93

Earth, Universe.

www.servebabiato.tk

• May 13, 2021

• #13

adderall said:

@Scorp

Try using Microsoft's Azure Front Door, it is most excellent!

Click to expand...

Its expensive can't afford that mcuh.

 

Scorp

Well-known member

Trusted Uploader

May 12, 2019

572

888

93

Earth, Universe.

www.servebabiato.tk

• May 14, 2021

• #14

guayaba said:

Well, considering we don't have any info about how do you host this... But first thing will be coollecting the logs of the DDoS and check what they are targeting. Based on that just deploy the proper rules on CF

Click to expand...

most of them are visiting my //xmlrpc.php page.
Screesnshot:
https://prnt.sc/12wv6cy

Screenshot

Captured with Lightshot

prnt.sc

Screenshot

Captured with Lightshot

prnt.sc

Trying to get username of admin : https://prnt.sc/12wvbm6

Screenshot

Captured with Lightshot

prnt.sc

 

SpiderWeb

Active member

Trusted Uploader

Sep 23, 2020

183

166

43

• May 14, 2021

• #15

Scorp said:

most of them are visiting my //xmlrpc.php page.
Screesnshot:
https://prnt.sc/12wv6cy

Screenshot

Captured with Lightshot

prnt.sc

Screenshot

Captured with Lightshot

prnt.sc

Trying to get username of admin : https://prnt.sc/12wvbm6

Screenshot

Captured with Lightshot

prnt.sc

Click to expand...

Block anyone accessing xmlrpc.php in cloudflare firewall as url path parameter

 

• 

Reactions: Scorp

SpiderWeb

Active member

Trusted Uploader

Sep 23, 2020

183

166

43

• May 14, 2021

• #16

Scorp said:

cpanel. My hosting has ngnix

Click to expand...

Check AWStats about name of unwanted bots, ip address. Block them.

Also are you using litespeed? It has inbuilt ddos prevention for l7 attacks

 

Scorp

Well-known member

Trusted Uploader

May 12, 2019

572

888

93

Earth, Universe.

www.servebabiato.tk

• May 14, 2021

• #17

Added firewall rule to cloudflare to block all visiting xmlrpc
Though I had disable xmlrpc using wordfence but it didn't work

Screenshot :
https://prnt.sc/12wxkeb

Screenshot

Captured with Lightshot

prnt.sc

 

SpiderWeb

Active member

Trusted Uploader

Sep 23, 2020

183

166

43

• May 14, 2021

• #18

Wrong setup. Block as url path...not url...

 

• 

Reactions: Scorp

biscuit

Well-known member

May 30, 2018

417

240

63

• May 14, 2021

• #19

You get hits every one minute. That is deffinetly not a ddos attack. A ddos attack will generate thousands of requests a minute.
Just create a cloudflare rule and block uri access to xmlrpc.php

 

• 

Reactions: Scorp

Scorp

Well-known member

Trusted Uploader

May 12, 2019

572

888

93

Earth, Universe.

www.servebabiato.tk

• May 14, 2021

• #20

SpiderWeb said:

Wrong setup. Block as url path...not url...

Click to expand...

Awstats 13 may screeshot: https://prnt.sc/12wyjsl
Cloudflare blocking : https://prnt.sc/12wyqem
Server stats never been such low : https://prnt.sc/12wyttm

@gopo
See : https://prnt.sc/12wyw42

I ask my hosting providers why Io operations where on 2G/s and Input/Output Usage. where on 1.9TB/s. Their reply was their might be some random bots or ddos attack.

@SpiderWeb Thanks for your help.