Ask HN: A botnet may be attacking our site right now, how should we respond?

37 points

12 years ago

It seems like our ecommerce site is under attack from a botnet, causing our site to go down. We're receiving 50-100 requests per second (far surpasses normal traffic). Some requests are for outdated URLs not even normally accessible from the site.

Here's IP data related to requests: https://gist.github.com/panabee/9595411. Can post more if more is needed for diagnosis.

Questions:

1) How do we confirm if the site is under attack?

2) If the site is under attack, how can we ward off the attack and prevent future ones?

3) We seem to have a ton of sleeping MySQL connections that continue to crop up even after we try killing them. Is this symptomatic of a botnet attack?

We appreciate any help or guidance anyone can offer.

Thanks!

42 comments