Warning: Bruteforce/DDoS against OpenCart based websites

But you are not sending the attack back. These people should learn for what are they doing with their own method.

khnaz35 wrote: ↑

Sun Jan 29, 2023 1:02 am

But you are not sending the attack back. These people should learn for what are they doing with their own method.

Have been using this for a few hours:
Sends back a multitude of different pages and network failures back to the compromised servers used by the attacker, and I assume these compromised servers will pass on the results (often pages with 200 status code) to the attacker himself for evaluation. Or at least it will pass on the user/password guesses (which are actually invalid anyway, though the attacker doesn't know it).

It has already decreased the number of requests to our server from this attacker by 70 percent. IMHO this can be a better strategy then merely responding with 403-results. We'll see. The goal is to make him give up, realizing he's just wasting his bandwidth and compromised servers.

Will compare this with another strategy which returns standard 404 responses later on, to see which works better.

The "main" problem of such "attacks" is, that mostly they come from infected websites those script kiddies have taken over or placed some scripts which sending requests automatically.
Means no real person stands behind.

While the idea of sending back to the original address (which I am using since years with success) is smart, finally not many will notice that.

Maybe I am wrong .. ?

Since i am using Cloudflare firewall I can see most of the attacks comes from US, Spain, China, & Ru IPs https://prnt.sc/RpfO0qJ8ICBA.
And noticed that user agent is always same with empty Post string https://prnt.sc/q_nZg7Iyb7Br

Many thanks Juergen Neuhoff for your help with my fake accounts & contact emails all coming from Spambots & mainly Russian Federation IP addresses. My system, Opencart 3.0.2.0 & my emails are now free from all this junk. Spambot works a treat since you installed it properly and you removed the Bruteforce DDos file.
Many thanks,
James
Bullet Polish Europe Ltd

Just to be clear: This particular bruteforce attack, as described on this forum thread, has the sole purpose of guessing the user/password of the admin. Spambots are different, their purpose usually is to send spam mails via the Contact page, or to do fake account registrations.

Try sticking Cidram on. It blocks traffic from known bad sources. You can set it to return a 500 error for stubborn attacks.

https://github.com/CIDRAM/CIDRAM