Share

Question

Hi,
We are currently trying to tackle some suspicious behavior on our digital ocean droplet that is causing the web server to crash every so often.

Here is the log:

181.176.75.66 - - [19/Jul/2018:14:53:09 +0000] "GET http://recargas.bitel.com.pe/?isdn=51927413962&old_url=http://recargas.bitel.com.pe/?isdn=51927413962&old_url=http://recargas.bitel.com.pe/?isdn=51927413962&old_url=http://recargas.bitel.com.pe/?isdn=51927413962&old_url=http://recargas.bitel.com.pe/?isdn=51927413962&old_url=http://recargas.bitel.com.pe/?isdn=51927413962&old_url=http://recargas.bitel.com.pe/?isdn=51927413962&old_url=http://recargas.bitel.com.pe/?isdn=51927413962&old_url=http://recargas.bitel.com.pe/?isdn=51927413962&old_url=http://recargas.bitel.com.pe/?isdn=51927413962&old_url=http://recargas.bitel.com.pe/?isdn=51927413962&old_url=http://recargas.bitel.com.pe/?isdn=51927413962&old_url=http://recargas.bitel.com.pe/?isdn=51927413962&old_url=http://recargas.bitel.com.pe/?isdn=51927413962&old_url=http://recargas.bitel.com.pe/?isdn=51927413962&old_url=http://recargas.bitel.com.pe/?isdn=51927413962&old_url=http://recargas.bitel.com.pe/?isdn=51927413962 HTTP/1.1" 200 1567 "-" "Apache-HttpClient/UNAVAILABLE (java 1.4)"

From what I can tell Its a Bot that has latched onto our IP. (The IP seems to be changing daily) but the logs are always the same.

I tried using IP tables to ban the IP address both incoming and outgoing to no avail. I also tried using UFW such as

Note the IP Address Originated from same 181.176.xx.xx 
Anywhere                   DENY        181.176.83.62
Anywhere on eth0           DENY        181.176.83.62

I can't understand why these commands aren't working and I have a feeling something is either wrong with my server setup or it's being superseded by something

It appears that the only way to prevent it reaching the server is by the use of Digital Oceans Cloud Firewall which is not ideal as we're using Cloudflare CDN who's IP Addresses change too often for me to manually keep the DOCF updated.

Any advice is greatly appreciated

Answer 1

jarland MOD July 19, 2018

Hello friend!

Sorry to hear about the trouble this is giving you. I'm happy to offer the best advice that I can. Is that IP hitting you directly or are you reading the forwarded IP from CloudFlare's headers and writing it to the log that way? This is going to be relevant as it means that neither firewall should function for blocking that IP as the traffic would actually be coming in through CloudFlare. If that is the case, you may actually be able to block the IP with CloudFlare themselves.

Kind Regards,
Jarland
Platform Support Lead

Reply

robatjam July 19, 2018

Hi Thanks for your reply.
It's hitting the server directly - I did also block it on CloudFlare.
What's troubling me the most is the request itself.
By the looks of it, using my server to redirect to spam another website?

Cheers,
Rob
- X40C July 20, 2018
  
  Maybe something like https://support.cloudflare.com/hc/en-us/articles/115001595131-How-do-I-Lockdown-URLs-in-Cloudflare- can help you out? Or maybe you could do the same with a reverse proxy either locally or on a separate box. Well, that if the request stays the same or at least the structure is only slightly changing(the numbers inside the url and the url size).

Answer 2

robatjam July 19, 2018

Hi Thanks for your reply.
It's hitting the server directly - I did also block it on CloudFlare.
What's troubling me the most is the request itself.
By the looks of it, using my server to redirect to spam another website?

Cheers,
Rob
- X40C July 20, 2018
  
  Maybe something like https://support.cloudflare.com/hc/en-us/articles/115001595131-How-do-I-Lockdown-URLs-in-Cloudflare- can help you out? Or maybe you could do the same with a reverse proxy either locally or on a separate box. Well, that if the request stays the same or at least the structure is only slightly changing(the numbers inside the url and the url size).

Digital Ocean Firewall overriding iptables?

Leave a Comment

Share

Share your Question

Digital Ocean Firewall overriding iptables?

Leave a Comment

Related Questions

Almost there!