1

I'm currently with a web hosting account whose servers seem to be constantly down due to DDOS attacks. I check my analytics daily and I'm seeing a major surge in fake traffic for several of my URLs totaling around 60 visits a day per site. Most of these are from Russia and through sources such as buttons-for-websites.com and other usual suspects.

So due to my frustration at never being able to connect to my own website I'm seriously considering moving to another host, but I'm assuming that because these spammers have my URL, they will keep hitting my site no matter what server I'm on, correct?

If so, I'd consider purchasing a new domain name when moving servers, but what steps should I take to prevent these unwanted visitors?

  • 2
    Assuming you have control over your NS records (e.g. in your domain provider's control panel), you could just use CloudFlare's free DDoS protection. – Polynomial Jun 29 '15 at 12:38
  • But it is not free. Free DDoS protection works this way: it stops giving out the site, so this is useless. – Vilican Jun 29 '15 at 19:04
  • 2
    Is the hosting company affected, or just your servers? 60 visits/day seems like trivial volume. – schroeder Jun 29 '15 at 19:11
  • Wait a second. If you change the domain name, how can the attacker find your new domain name. The DDOS attack on a specific page will resort to the home page or domain web root, if the targeted page is removed. But once the domain name is disconnected from the IP address, how can an attack continue? – Charles Robertson Jul 22 '18 at 10:00
1

Full disclosure, I work for a DDoS mitigation company protects companies against DDoS attacks.

A few ways you can dodge DDoSers can be through blocking the attackers by IP or country. Blocking by IP will block access from those specific attackers, so long as they're trying to access your site via that IP, they will be blocked. Blocking by country can also be useful if you know you don't do business with certain countries. According to Incapsula's recent DDoS Report, most attacks can be routed or sourced through China or Russia. If you know you don't serve those countries, you may be better off to block them.

Most attacks are sourced through Botnets, or a number of computers that are hacked and used to attack your website. Slowing down your website will do nothing to deter them because they're bots, they don't care. Your users will notice and they will be pissed though so it's best not to do that.

I recommend adopting a service like Incapsula. You can block bots under a certain point.

Hope that helps!

  • How realistic is it to country-block certain areas? With the shortage of IPv4 addresses, sometimes addresses assigned to APNIC are in the US, and ARIN IP addresses in Europe, etc; making geolocation a constant guessing game -- and country block a very blunt instrument prone to issues. Does anyone actually use country block on production sites? – Herringbone Cat Jul 20 '15 at 18:09
0

As far as DDoS mitigation goes, simply changing your domain name isn't going to help. It's kind of like playing a shell game, "whoops I moved here", and it won't take long for the bots to again hone in upon your new hosting provider.

Essentially any open port on any public IP will be receive bot/scan traffic, so a security-through-obscurity solution is unlikely to be very effective.

I'd recommend perhaps using a proxy service like CloudFlare (as previously recommended by folks in the comments) to help get rid of bot traffic. All legitimate traffic could go through the proxy services' servers, and you could firewall off all web traffic not going through the proxy; effectively causing bot traffic decline to minimal levels.

If that isn't an option, there are many managed cloud hosting providers out there that specialize in security. They typically offer features such as DDoS Mitigation, web application firewalls, intrusion detection systems, etc. It might cost significantly more to move to this type of an infrastructure, but you'd be offloading much of your security concerns (especially vis-a-vis network/DDoS like this) to the provider.

0

I'm assuming that because these spammers have my URL, they will keep hitting my site no matter what server I'm on, correct?

That's correct.

Those 60 visits a day should really not be a problem, either your page are doing some insanely heavy operations on each pageload or your host is trash.

What steps should I take to prevent these unwanted visitors?

Requests like those will always exist when your website is public, but they should not be a problem.

You could use CouldFlare to get rid of some of the bot traffic, but a bunch of bot requests still reach the server.

So check your page - If the page is not the problem your host is.

0

You usually won't see DDoS traffic on your analytic page.

That's because GA and others rely on Javascript, while the vast majority of DDoS Bots don't support JS.

For referer spam such as buttons-for-websites, semalt and others, you need some bot access control. more information available here.

Disclosure: I work @ Imperva Incapsula, a CBSP which provides Cloud WAF/DDoS Mitigation/CDN/GSLB.

-3

Try making a site delay. When anyone attempts to access the site, make it so there is a 5 second delay. Real users won't be bothered by this, but it will reduce denial-of-service attacks significantly.

  • Why so many downvotes? – The Broken Ace Jun 29 '15 at 20:11
  • Because it is wrong: it doesn't offer any protection while, at the same time, bothering legit users. – Stephane Jun 30 '15 at 7:41
  • @Stephane Oh. Thank you for telling me this, I see a lot of websites like this and I thought it might help. – The Broken Ace Jul 1 '15 at 18:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.