0

I have a WordPress site. Recently under a serious DDoS attack.

For this WordPress site I use nginx, varnish and apache in the backend.

A part of access log shows this:

24.41.213.36 - - [23/Jun/2019:12:58:13 +0430] "GET / HTTP/1.1" 301 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E; AskTbPTV/5.15.1.22229; BOIE9;ENUS;CloudVersion)" 
88.255.108.4 - - [23/Jun/2019:12:58:14 +0430] "GET / HTTP/1.1" 301 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E; AskTbPTV/5.15.1.22229; BOIE9;ENUS;CloudVersion)" 
189.157.252.135 - - [23/Jun/2019:12:58:14 +0430] "GET / HTTP/1.1" 500 588 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E; AskTbPTV/5.15.1.22229; BOIE9;ENUS;CloudVersion)" 
155.232.186.14 - - [23/Jun/2019:12:58:14 +0430] "GET / HTTP/1.1" 301 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E; AskTbPTV/5.15.1.22229; BOIE9;ENUS;CloudVersion)" 
27.147.183.238 - - [23/Jun/2019:12:58:14 +0430] "GET / HTTP/1.1" 301 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E; AskTbPTV/5.15.1.22229; BOIE9;ENUS;CloudVersion)" 
186.167.66.149 - - [23/Jun/2019:12:58:14 +0430] "GET / HTTP/1.1" 400 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E; AskTbPTV/5.15.1.22229; BOIE9;ENUS;CloudVersion)" 
186.167.66.149 - - [23/Jun/2019:12:58:14 +0430] "GET / HTTP/1.1" 400 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E; AskTbPTV/5.15.1.22229; BOIE9;ENUS;CloudVersion)" 
103.248.119.141 - - [23/Jun/2019:12:58:14 +0430] "GET / HTTP/1.1" 301 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E; AskTbPTV/5.15.1.22229; BOIE9;ENUS;CloudVersion)" 
202.62.49.119 - - [23/Jun/2019:12:58:14 +0430] "GET / HTTP/1.1" 301 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E; AskTbPTV/5.15.1.22229; BOIE9;ENUS;CloudVersion)" 
177.44.175.204 - - [23/Jun/2019:12:58:15 +0430] "GET / HTTP/1.1" 500 588 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E; AskTbPTV/5.15.1.22229; BOIE9;ENUS;CloudVersion)" 
14.102.76.42 - - [23/Jun/2019:12:58:15 +0430] "GET / HTTP/1.1" 301 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E; AskTbPTV/5.15.1.22229; BOIE9;ENUS;CloudVersion)" 
181.113.225.198 - - [23/Jun/2019:12:58:15 +0430] "GET / HTTP/1.1" 301 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E; AskTbPTV/5.15.1.22229; BOIE9;ENUS;CloudVersion)" 
202.51.103.82 - - [23/Jun/2019:12:58:15 +0430] "GET / HTTP/1.1" 301 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E; AskTbPTV/5.15.1.22229; BOIE9;ENUS;CloudVersion)" 
88.12.48.61 - - [23/Jun/2019:12:58:15 +0430] "GET / HTTP/1.1" 301 0 "-" "Mozilla /4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E; AskTbPTV/5.15.1.22229; BOIE9;ENUS;CloudVersion)" 
84.243.197.97 - - [23/Jun/2019:12:58:15 +0430] "GET / HTTP/1.1" 400 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E; AskTbPTV/5.15.1.22229; BOIE9;ENUS;CloudVersion)" 
45.234.144.106 - - [23/Jun/2019:12:58:15 +0430] "GET / HTTP/1.1" 500 588 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E; AskTbPTV/5.15.1.22229; BOIE9;ENUS;CloudVersion)"

Do you have any idea for this attack?

  • 4
    I see only GET /, why do you think it's an attack? What did the request look like to get HTTP 400? What caused the HTTP 500? – Z.T. Jun 23 at 19:46
  • GETs do not look like a DoS attack, and 8 requests in a minute are certainly not a DDoS attack. If it was a DDoS attack, I'm not sure what you are asking. Ideas about what? – schroeder Jun 24 at 7:10
  • true log should be something such as the following: 37.98.68.156 GET /wp-content/uploads/2015/04/xx.png HTTP/1.1" 301 0 "r.yxzyxz.net" "Mozilla/5.0 (Linux; Android 8.0.0; SM-A320F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.99 Mobile Safari/537.36" But it seems our Nginx logs were not Normal during attack time! How should we find out what domains are requested from these messy logs? Moreover, suddenly the server bw increased from normal range 10-20 Mbs to around 500Mbs and the Nginx connections increased to 6000 which was 10 times more than the usual time as well. – serversetup co Jun 24 at 10:05
  • This was just a few requests to view. Requests from all over the world IP were sent to the server. Thousands of requests have been received with the same structure in Nginx logs. – serversetup co Jun 24 at 11:04
  • Please edit your question to include these details. You also need to answer the question about what you are asking about. Do we have an idea? Yes. You are being DDoSed. Is that all you wanted to know? – schroeder Jun 24 at 11:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.