Site being attacked - Bot downloading videos constantly

Discussion in 'Site & Server Administration' started by akilar, Mar 19, 2011.

0
  1. #1
    Hi There

    I have a client with an adult site, weve recently exceed our bandwidth with our host, we have our own box, and 1,500 GB per month download, usually we hit about 100 gigs per month.

    Recently however, the download spiked, traffic however, remained constant.

    What we found in the access logs is that someone or something (eg bot) is downloading the videos, constantly, they are using a varied range of IP addresses. A line from the access log would look like this

    95.25.253.212 - - [11/Mar/2011:19:58:07 -0500] "GET /media/trailers/tlof20110227a-trl6uHk.flv HTTP/1.1" 200 2485863 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15"
    Code (markup):
    wher as a regular user watching a trailer i believe looks like this line

    121.79.225.133 - - [11/Mar/2011:20:29:27 -0500] "GET /media/trailers/tlof20110307a-trl4HYq.flv HTTP/1.1" 200 2574294 "http://www.domain.com/mediaplayer/player.swf" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16"
    Code (markup):
    I was thinking block the ip's via htaccess, but they must have proxy servers or something, then i thought of using a PHP file to get the contents of the FLV file, but then that php file could just be called, and the same bandwidth issues would happen again.

    Can anyone think of any possible solution, this is costing us a fortune.

    Regards

    Paul
     
    Last edited: Mar 19, 2011
    akilar, Mar 19, 2011 IP
  2. rod.maqstuirt

    rod.maqstuirt Peon

    Messages:
    11
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #2
    Use generated links. For apache read:
    http://code.google.com/p/mod-auth-token/
    Code (markup):
    For lighttpd google mod_secdownload
     
    rod.maqstuirt, Mar 20, 2011 IP
  3. digitalpoint

    digitalpoint Overlord of no one Staff

    Messages:
    38,334
    Likes Received:
    2,613
    Best Answers:
    462
    Trophy Points:
    710
    Digital Goods:
    29
    #3
    A short-term solution might be to block users downloading videos if they have no referrer.
     
    digitalpoint, Mar 21, 2011 IP
  4. dlmoredotcom

    dlmoredotcom Peon

    Messages:
    164
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #4
    Limit parallel download connections, set more interval time between download request.
     
    dlmoredotcom, Mar 31, 2011 IP
  5. devonblzx

    devonblzx Peon

    Messages:
    27
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #5
    Another trick is to use something like DDOS deflate. Not sure if it would help in your solution, but it does help with most minor DOS attacks.
     
    devonblzx, Apr 2, 2011 IP
  6. cPAce

    cPAce Peon

    Messages:
    445
    Likes Received:
    8
    Best Answers:
    0
    Trophy Points:
    0
    #6
    I agree with dl on this one. Just limit the parallel downloads. What control panel does your server use?
     
    cPAce, Apr 2, 2011 IP
  7. GlacialGaming

    GlacialGaming Peon

    Messages:
    38
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #7
    I agree with Digitalpoint, You can just block anyone from downloading if they have no referer.
     
    GlacialGaming, Apr 5, 2011 IP