Recently, one of my servers came under attack by DDoSing it. After inspection of access logs, I can only find one common denominator: Referrer.

All of request come with (I assume) fake referrer:

Obviously, all of these are legitimate websites, so I was wondering what would sound strategy against those?

I read an article about a similar attack:


  • 1
    A sound strategy for what, exactly? What was the traffic doing? Was it just high bandwidth? Have you considered a DDoS mitigation service?
    – schroeder
    Oct 21, 2020 at 20:33
  • Just running GET requests again index page. Request size varies between 100 and 500b, so the high bandwidth does not seem to be the target. As for the DDoS protection, we cannot do that due to a funky DNS configuration that is way beyond our jurisdiction :(. We hit the wall with Cloudflare last week when we attempted to set it up :( Oct 21, 2020 at 21:49
  • I was thinking about blocking requests by Referrer, but that sounds too risky of hitting legitimate visitors, right? Oct 21, 2020 at 21:50
  • @JovanPerovic if the traffic isn't coming from a real browser, the referrer header can be nonpresent or set to whatever they want. Oct 22, 2020 at 2:46
  • @multithr3at3d Either they are masking it very well or user agents seem totally legitimate. So far everything points in a direction of an infected botnet... Oct 22, 2020 at 11:20


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.