1

I just had a look at the firewall status and saw it had blocked over 300 requests from TOR, Python Urllib, and some script called aabbccdd.xss.ht/pigeonburger.xyz (pigeonburger.xyz being my website).

All of them are trying to access a non-existent page on my website (/wp-admin.php).

My site is not on Wordpress, I run it by myself.

My firewall is easily blocking the requests, but I'm worried that it may escalate.

This looks extremely suspicious to me, so I have a few queries:

  • Does anyone know what https://aabbccdd.xss.ht is??? It seems like some sort of security testing service that gets abused a lot. A quick Google search brought up what looked to be Russian penetration testing sites, and something called cross-site scripting. Should I be worried about that?
  • What else should I do to prevent these attacks? My site is only really small, and doesn't get a huge number of visitors. I really don't want it to get to the point where my server crashes or something like that.
1
  • Cross Site Scripting is a very well documented issue with millions of resources explaining it, including the tag you used on the question. A quick Google search will flood you with all you need to know about that.
    – schroeder
    Commented Oct 22, 2020 at 7:40

1 Answer 1

2

If you want your service to be accessible to the public, then you cannot prevent the public from interacting with your service. Because of the nature of the web, you cannot prevent someone from accessing arbitrary resources on your site, even if they don't exist. So, you can't prevent the attacks.

There are techniques to detect when someone is trying to access things that do not exist (like /wp-admin.php) or from certain sources (like aabbccdd.xss.ht) and to block that IP from further interaction. But that tends to be more trouble than it's worth, and it will never be complete.

The better approach is to make sure your site can survive these random probes of your site, detect when things go wrong, and be able to respond quickly and effectively when they do. Because you want to run this server by yourself, then all that fall to you. And that's why most people host their sites with a service that can do that for them.

2
  • 1
    Completely agree; just like to add rate limiting connections/requests by IP can help mitigate the load on your server from the really low-tier stuff. Commented Oct 22, 2020 at 11:06
  • 1
    Thanks - I think my best choice is probably using the Cloudflare CDN. Its reverse proxy and extra firewall rules are probably better for my site. @JoseFernandoLopezFernandez That's what I also ended up adding (limiting the reqs and conns). Commented Oct 22, 2020 at 22:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .