Tag Info

New answers tagged

9

How can I defend against malicious GET requests? These requests do not look really malicious. At least based on your description they don't cause any harm, i.e. no unwanted code execution, SQL injection or similar attacks. They only need some resources to process. What you see is what every operator of a web server can see in the log files: lots of ...


5

In conjunction with what @SakamakiIzayoi suggested: Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any ...


4

The easiest defense solution would be to install a Web Application Firewall. You can find in-depth descriptions regarding them on OWASP and Wikipedia. I doubt the requests would slow down your site. Attackers would most likely request existing items as it would be far more effective in wasting your web-server's resources.


1

First of all, don't run an Open Relay. It will rapidly be found and exploited by scammers and your IP will be in RBLs all around the world. Set up SMTP auth for your server, then configure it so that each account can send a maximum amount of messages per day. Concerning the problem on the mailbox's end, there's not much that can be done to defend oneself ...


1

@Jeroen-it-nerdbox is right and that is my recommended course of action as well. However I will try to contribute to a more general situation (when its not a legitimate company). Still the bandwidth situation is something you need to check with your ISP. As for the attack itself, when a request comes from an external network it reaches your router first, ...


1

Apparently this traffic is coming from the Google Network: NetRange: 74.125.0.0 - 74.125.255.255 CIDR: 74.125.0.0/16 NetName: GOOGLE I'd recommend to send an abuse e-mail with the logs attached to: OrgAbuseEmail: arin-contact@google.com Are you running any services? Could it be a Google bot crawling you too fast? ...


1

Reading through this memo, a link is given to the un-pin draft of Perrin here. I see two countermeasures against the scenario which you describe in this draft: Let's start with the first one, which can be interpreted in different ways: Whenever a client performing "pin activation" sees a hostname and TSK combination not represented in the "pin ...



Top 50 recent answers are included