Someone started attacking my site a few minutes ago and its caused PHP-FPM to max out all cores (4) on my vps and NGINX is now serving 502 to all users.
I'm seeing a bunch of these requests with tons of different agents
xx.xxx.xx.xx - - [10/Nov/2014:5:14:35 -0500] "POST / HTTP/1.1" 502 574 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.47 Safari/536.11"
I'm also seeing a bunch of requests from various WordPress sites
xxx.xx.xxx.xxx - - [10/Nov/2014:5:14:35 -0500] "GET / HTTP/1.0" 502 172 "-" "WordPress/3.9.2; http://www.xxxxxxx.com; verifying pingback from xx.xxx.xxx.xxx"
What kind of attack is this and how do I help mitigate it? Seems like some sort of botnet, its tons and tons of requests a second from all different IPs and agents.
I'm running a forum so my site heavily relies on nginx passing to php. I'm on NGINX 1.7.7 and PHP 5.6.2 if it matters. NGINX has practically zero load during the attack.
Edit: So apparently I didn't give enough information.
I run a pretty small forum - maybe 100-200 unique members a day. Normally very very low load - I have things cached and configured pretty well. Someone came on my site and TOLD me he was going to attempt to take down my website. A few minutes later, my logs were filled with hundreds (per second) of these POST and GETs from all different IPs and various wordpress blogs. The site started to serve 502 errors. I checked the server usage using HTOP and saw php5-fpm using almost 100% of all 4 cores of the VPS. I quickly shut down nginx and the load immediately went to zero. I left it off intentionally for a few hours and put it back up to find the attack had stopped.
While there is no active attack right now, i'd like to help mitigate what this user was able to do. I'm using OVHs network so I'm covered by their Anti DDoS VAC system - however this appears to be on the application level and obviously that wouldn't help me here.
I'm not too clever with web servers, so I don't know how to "check" what was in these post requests. All I see from my access logs are floods of unique IPs all doing POST to the root of my domain.