How to find out which website is under DDOS or being attacked?

Bryan McClure · Aug 16, 2019

Hello,
I have 6 websites on a VPS, sometimes one of them seems getting DDOS attacks and it is making my server overload. How can i find out which website is under DDOS or being attacked? any help?

EthernetServers · Aug 16, 2019

Do all 6 websites use the same IP address?

hostens · Aug 17, 2019

Usually, the attack is for the specific IP address the website is using. If the attack is to the specific site, you should be able to see the information in the Apache logs in the server. The site getting the attacks will have a full log of the requests to it.

rowebca · Nov 10, 2019

You can use "netstat" command to check this:

Bash:

netstat -ntu|awk '{print $5}'|cut -d: -f1 -s|sort|uniq -c|sort -nk1 -r

You should investigate if is 100+ / ip.

Regards

ronica · Nov 11, 2019

Hi,
use this command for see all attacker IP

Code:

netstat -anp |grep ‘tcp\|udp’ | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n

netstat -n | grep :80 | grep SYN |wc -l

netstat -n | grep :80 |wc -l

when my hosting or dedicated server is under ddos attack i find attacker ip with this command
best solution for find ddos attack in vps hosting and dedicated server is use netstat

Regards -

offshore hosting

NoFrillsCloud · Nov 13, 2019

Going forward you may want to put your websites behind CloudFlare which will help cut down a majority of attacks.

The CloudFlare Free plan is good enough so there's no reason to not use it IMO.

tuxandrew · Dec 3, 2019

You can find the attackers IP using the netstat command, but if it DOS attack only then blocking the IPs would save the server, for DDOS attacks, the attacker IPs would be changing constantly, so blocking the IPs is not a solution.

Alternately you can check the Apache access logs, find which log file is written more and which url was accessed heavily in past hours, that would make a better sense on the attacked target on your server.

In the case of DDOS, either you need contact the provider for any hardware filters to filter the traffic.
If the attack is url/domain specific then you should be using any thirdparty services like CLOUDFLARE to filter the traffic.

serveria · Dec 16, 2019

If you're on cpanel just check Apache Status when attack starts. That should give you a hint on which domain is being attacked.

tuxandrew · Dec 16, 2019

Yes the access logs can reveal more information on attacked domain/ur/ and the external IPs.

How to find out which website is under DDOS or being attacked?

Bryan McClure

Well-known member

EthernetServers

Member

Bryan McClure

Well-known member

hostens

Well-known member

Bryan McClure

Well-known member

VirtuBox

Well-known member

rowebca

New member

ronica

New member

David Beroff

Well-known member

NoFrillsCloud

Member

tuxandrew

Well-known member

serveria

Member

Harry P

Well-known member

tuxandrew

Well-known member

Harry P

Well-known member

Latest posts New threads

Latest posts

New threads

Latest Hosting Offers New Reviews

Latest hosting offers

Popular Contributors - Past 30 Days

Sponsors

Tag Cloud