Site getting hammered by botnet traffic - Help please

Discussion in 'Site & Server Administration' started by andyleem, Jan 5, 2013.

  1. #1
    Hi
    Recently my sites were hacked and malicious files were added, which was sending out spam emails. I cleaned up the server and removed the files.

    Now on one of the site I'm getting over a thousand hits a day to one of the files (which is no longer there).

    /checkoutHyg.php

    The IP's are always different but some IP's come back to visit the file at different times. The IP's vary in country.

    The user agent for every hit is just:

    Mozilla/5.0

    Nothing else.

    I have tried putting this in my htaccess but it doesn't stop the traffic:

    # BLOCK USER AGENTS
    RewriteEngine on
    RewriteCond %{HTTP_USER_AGENT} Mozilla/5\.0 [NC]
    RewriteRule !^robots\.txt$ - [F]

    # BLOCK BLANK USER AGENTS
    RewriteCond %{HTTP_USER_AGENT} ^-?$
    RewriteRule ^ - [F]


    Please can someone help?


    Thanks
     
    andyleem, Jan 5, 2013 IP
  2. zacharooni

    zacharooni Well-Known Member

    Messages:
    346
    Likes Received:
    20
    Best Answers:
    4
    Trophy Points:
    120
    #2
    <FilesMatch "^\/checkoutHyg\.php$">
    Deny from All
    </FilesMatch>

    Place the above in your .htaccess file, and it should block the attempt before it invokes PHP.
     
    zacharooni, Jan 6, 2013 IP
  3. ryan_uk

    ryan_uk Illustrious Member

    Messages:
    3,983
    Likes Received:
    1,022
    Best Answers:
    33
    Trophy Points:
    465
    #3

    Mozilla/5.0 is in so many browser user agents, it's a bad idea to block it (if you want visitors to your site).

    What zacharooni mentioned will stop the requests.

    You might want to consider installing something like Bad Behavior:
    http://bad-behavior.ioerror.us/about/

    It won't stop you getting hacked by humans (I assume you've closed the security hole and done a thorough audit for vulnerabilities in the server/code?), but it will stop a lot of bots.
     
    ryan_uk, Jan 6, 2013 IP
  4. andyleem

    andyleem Active Member

    Messages:
    490
    Likes Received:
    27
    Best Answers:
    0
    Trophy Points:
    83
    #4
    Hi
    What I mean by blocking that user agent is blocking it is it is exactly 'Mozilla/5.0'. so putting $ on the end.
    I also added the code you mentioned

    Is there any way of blocking it completely as I still see the POST requests in the apache log?

    Thanks
     
    andyleem, Jan 8, 2013 IP
  5. ryan_uk

    ryan_uk Illustrious Member

    Messages:
    3,983
    Likes Received:
    1,022
    Best Answers:
    33
    Trophy Points:
    465
    #5
    Well, as it's coming from multiple IPs it's not an easy one to filter. You can stop it appearing in the Apache log, but that's not what you want.

    Contact your host. If they are a good one then they should be able to block traffic to that URL before it hits your server. Otherwise, track down a host that can.
     
    ryan_uk, Jan 8, 2013 IP
  6. 123addme

    123addme Active Member

    Messages:
    171
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    58
    #6
    I think malicious file is random name.
    You should backup database then reinstall all script with clean source.
     
    123addme, Jan 25, 2013 IP