Our server has recently become a target of what appears to be a botnet attack. The first indication was an insane amount of traffic to one of our client's websites - so heavy that the server entirely stopped responding. I believe we had somewhere near 200 queued requests on the server when I checked on it.
I've concluded that it is a botnet because each IP sends at most 3 requests. These requests seem to be targeting login/registration pages. Originally they were brute forcing user info pages (/user/lkjasd) to see if the user existed, and then trying to login as them if not.
My initial response was to set some RewriteRules for that VHost that detected all of the login/registration/user pages and send 403's immediately (only administrators login on this site, and that is rare). This has taken the load off our server because of the quick response, so all of our sites are back up.
However, I am now 3 days into that solution, and the attacks have not slowed. They've cut out most of the login/registration attacks, and now are sending GET and POST requests to my homepage, with the referer set as /user/login. I'm assuming this is an attempt to hijack a session or trick the site into thinking they just logged in.
Obviously I can't setup a RewriteRule to 403 on the homepage, so how else can I defend against this? The traffic isn't unbearable, but it makes me uneasy just letting them run, and I'm a bit nervous about my bandwidth bill at the end of the month.