Website is under attack, how to deal with the constant requests

Question

When i logged on cpanel this morning, i noticed tens of thousands of requests for pages that don't exist coming from a few IPs.

links such as : /cgi-bin/1998, /cgi-bin/1999, /cgi-bin/2000 etc..

What are they trying to do and how to protect myself against it ?

They're still scanning the site as we speak.

If you don't like getting attacked by bots, then disconnect yourself form the internet. — rook, Apr 11 '17 at 22:49
https://security.stackexchange.com/questions/113172/how-do-you-deal-with-massive-port-scans — julian, Apr 11 '17 at 23:04
https://security.stackexchange.com/questions/74058/is-there-a-best-practice-to-handle-vulnerability-scanning-attempts — julian, Apr 11 '17 at 23:06

score 1 · Answer 1 · answered Apr 12 '17 at 00:20

Setup Fail2Ban, or it's equivalent, to automatically block the IP addresses scanning you. They may try again from other IP addresses but this will radically slow them down. It will also make their efforts more expensive labor-wise and in most cases, it will stop them quickly.

Fail2Ban is easy to setup quickly. Once you have more time look into tools like mod_security and integrate that into your Fail2Ban setup.

Website is under attack, how to deal with the constant requests

1 Answers1