Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : Attack from a Botnet on my Root Server, with the same Referer.

[Internoc24]

Hello, on one my root server runs a DDOS attack, apparently from a Botnet, however all have the same Referer. Who can give me Tipps, how I can prevent the attacks? Preferably evenly stop over the Referer?!



Please move to the Right Forum, if i post this Topic in the wrong forum.

[david510]

You can install mod_security on the server and can filter out the requests with HTTP_REFERER option. A sample rule is below.

SecFilterSelective HTTP_REFERER|HTTP_USER_AGENT "<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>"
SecFilterSelective "HTTP_REFERER" "(poker|loan|mortgage|hold-em)"

[Internoc24]

i have a screenshot..beauce i can not post here ( wht dont allow it)

i hope anybody can help me..send me an PM so that can i send anybody the screenshot..

[bear]

Originally Posted by Black-Host

i have a screenshot..beauce i can not post here ( wht dont allow it)

Plenty of free image hosting sites out there. Why not sign up and use one of those, posting the link here?

[david510]

Black-Host,

Did you try installing mod_sec?

[Internoc24]

i must have 5 post to post the link here...

i am not sure if mod_sec was installed, but my competition for linux is not so high, so that an another person make all works on my root..

[Internoc24]

http://img221.imageshack.us/img221/1421/attackys9.jpg