5

It seems that I am the target of a mysterious ongoing hacking attempt.

I have several domain names, most of which are currently parked & pointed at a single ‘main’ website. For the last couple months, at least a few hours per day, I’ve had a perplexing (yet seemingly harmless) issue with what appears to be useless, garbage traffic directed at my sites. I’m not sure why/if I need to bother doing anything about it.

The rate of "attack" varies but is usually around 5 hits/min, although twice over the weekend there were over 100,000 hits within 2 minutes. My web host isn’t concerned, presumably since their system stops an attack if it becomes a problem - which it did once before for my site, a few weeks ago.

The majority of the traffic is coming from one country but a third of it is spread out across the world, some ranges of IPs return no geolocation data from the free API.


As far as I can tell, I only see this traffic doing two things:

  1. Most times, it's just “visiting pages” on my tiny site, as well spamming gibberish through a contact form . . . somehow defeating the reCaptcha, but this isn't causing much more than a “minor annoyance” solved by hitting “Select All+Delete” in a mail folder once a week.

  2. Mostly just during the "big attacks”, it almost exclusive hits a single static page that contains only a single Google Map - the uncomplicated php adapted from one of Google’s online code demos.

The traffic generates an error on the page which is logged as an “Undefined variable” – oddly, I can’t reproduce the error. There were 2 "major attempts" like this in the last 2 days and a third a few weeks ago (though I'm not sure of the target in that case).

Although the page loads the location data from a table, the calculations are done server-side so the only data sent to the client is an "adjusted" marker location (skewed at a random factor) and the name of the city. The simple page takes no user input, and is non-interactive (other than the map controls that are built-in to Google’s map.)

The geo-location data (from a free API) is of questionable accuracy to start with, but even if it was a list of home addresses I still can't imagine why it would be of value to anyone, or worth this much effort.

img

I figure it obvious from looking at the map that the data is skewed, so perhaps that's irrelevant to this person's goal? - especially knowing that literally 99.99% of the pins locations of the traffic itself. (Also the main source of traffic is intentionally excluded from the sections shown.)

I'm a new very small business (no sales yet) with nothing of value on the server or elsewhere. Since my web host isn’t concerned about it, and it doesn’t really affect me (beyond my time in writing this question) – is this of any concern?

What do you suppose this party is trying to accomplish? Could they be practicing for something? Waiting for something on my site so they can jump to action and steal . . . the rest of my google code demo’s? Did I make an anonymous enemy who’s planning to ever-so-gradually “annoy me to death”?

Someone’s definitely either very persistent or patient as I estimate the total’s approaching a million visits and/or errors, in 2+ months.

Thoughts?

4

It's almost certainly an automated scan of bots looking for low hanging fruits to attack. I would not spend any considerable time investigating it further. Consider something like fail2ban instead, and block gelocation's IP address to rid yourself of the nuisance.

It's probably targeting the .php page more because it's a php and is dynamic content or input (and therefore could allow RCE, SQL injection, PHP command injection, etc) and less because it's Google Maps.

  • Thx for your answer!+ I still don't understand why anyone would invest months into a site with no value to anyone? - no products, no site visitors yet, no data. Even if they go in and deleted everything, I have a backup copy which could be restored in minutes. (again, no business to interrupt) Also as noted, the page in question has no input fields and takes no parameters - so SQL injection etc is impossible, correct? No logins/passwords etc. It's practically a static page on the frontend. – ƬƦƖƝƛ Mar 5 at 6:36
  • Also is there any benefit to using ban software like Fail2Ban, as opposed to just listing the IP's in htaccess as a "deny"? (I've always wondered if htaccess is failproof?) – ƬƦƖƝƛ Mar 5 at 6:37
  • If I've answered this for you, please mark it as "answered" by putting the check mark next to the upvote :) – SomeGuy Mar 5 at 20:17
  • It's really not about value in terms of PII, but if they can compromise your server, they can (quietly try?) use it to host other info, make it a zombie bot, etc. I once had a client whose website's base URL had inserted directories and was selling used Korean autoparts off his directory root because he didn't update his wordpress plugin. – SomeGuy Mar 5 at 20:19
  • Fail2ban automates the process, so you don't have to keep sticking more and more IP's in .htaccess. I also advise most of my clients to block them at the firewall and network/ASA level using ACL's, but if you're selling internationally, you may not want to. Personally,l for most of the clients I work with, they don't need any IP's outside of the US. I use foreign country proxies all the time, but in such cases I can temporarily switch to Canadian or South American IP that isn't blocked or whatever. – SomeGuy Mar 5 at 20:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.