Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why is my web server being attacked?

news.ycombinator.com

Post reply on HN
Print view View original

41–48 of 48 posts

Re: Ask HN: Why is my web server being attacked?

#41

Post by hedora »

throwaway67743 wrote: post #34
Erratic6576 wrote: post #20

Earlier quoted context omitted.

Have you tried changing the web browser or VPN?

Enabled cookies? Checked your TCP/IP settings?

I used to have similar problems (and also hell bans at random web sites) because I had a small ISP that uses CGNAT. Somewhere in my zip code, there was probably an infected windows box or something.

You might check your IP in an IP reputation database.

I eventually switched to a larger, more soulless ISP (also CGNAT) because we can’t have nice things on the internet any more.

Re: Ask HN: Why is my web server being attacked?

#42

Post by dizhn »

solardev wrote: post #22
codegeek wrote: post #15

Earlier quoted context omitted.

Cloudflare won't protect your IP being hit directly. If your IP can be accessed publicly, it will get hit. period. You could use nginx etc to do a 444 status code but can't stop these scripts/bots from hitting ur IP completely.

Normally you'd just configure the firewall to drop all packets not from Cloudflare. Maybe also get a new static IP first.

Is there a different set of IPs for Warp? That would have to be denied too.

Re: Ask HN: Why is my web server being attacked?

#44

Post by scrps »

Sounds like an amplification attack, you are just in a rotation with a ton of other random hosts generating the traffic which is probably why the packet rate is low.

You could try doing some research on the forged IPs and see who they are associated with. Also try pinging them, my guess is they are down or returning insane latencies.

Either way I wouldn't lose sleep, any server I've ever managed or owned always got weird little visits from the packet goblins from time to time, it is fun puzzling them out. Once is an accident, twice is a coincidence, three times is an enemy action.

Re: Ask HN: Why is my web server being attacked?

#45

Post by taskforcegemini »

cameron_b wrote: post #9

Adding to what has already been said- New registrations are the food for probing. You could have an IP on someone's naughty list from a previous user. It's any other day on the internet. That's just what the neighborhood ( the whole internet ) looks like from the sidewalk. So, Set up a free Cloudflare account, move your DNS of record to them, and run traffic through Cloudflare to your server.

that is terrible advice for the internet as a whole. cloudflare is too ubiquitous already which comes with a lot of potential danger. In other words: if you can afford not to use cloudflare, please don't.

Re: Ask HN: Why is my web server being attacked?

#46

Post by DANmode »

donatj wrote: post #13

In my general experience, everything on the open web is being probed and attacked, all the time, always. That's just kind of how it goes. Bots scan the web looking for holes to get in and cause trouble. They'll poke your stuff.

That's the answer for sure: because it's connected to the internet.

Re: Ask HN: Why is my web server being attacked?

#48

Post by soultrees »

hrbrmstr wrote: post #38

These "noise storms" are becoming more common than in previous years and are generally tied to global "major" events. This: https://observablehq.com/@greynoise/noise-storms has some explanation but I'd be glad to elaborate more if needed.

Please do.
Post reply on HN