Not sure if SO is the right forum, but we're in need of help and perhaps programmatic elements may comprise the final solution. Instead of downvoting, please recommend where to post this question, and we'll gladly remove this from SO. Thanks -- we just want to overcome this attack.  It seems like our ecommerce site is under attack from a botnet, causing our site to go down. We're receiving 50-100 requests per second (far surpasses normal traffic). Some requests are for outdated URLs not even normally accessible from the site.  Two questions:  1) How do we confirm if the site is under attack?  2) If the site is under attack, how can we ward off the attack and prevent future ones?  We appreciate any help or guidance anyone can offer.  We're using Tomcat 6.0. (Don't ask why. You don't want to know.)  Thanks!
2444
This is a  about DoS and DDoS mitigation.   I found a massive traffic spike on a website that I host today; I am getting thousands of connections a second and I see I'm using all 100Mbps of my available bandwidth.  Nobody can access my site because all the requests time out, and I can't even log into the server because SSH times out too!  This has happened a couple times before, and each time it's lasted a couple hours and gone away on its own.  Occasionally, my website has another distinct but related problem: my server's load average (which is usually around .25) rockets up to 20 or more and nobody can access my site just the same as the other case.  It also goes away after a few hours.  Restarting my server doesn't help; what can I do to make my site accessible again, and what is happening?  Relatedly, I found once that for a day or two, every time I started my service, it got a connection from a particular IP address and then crashed.  As soon as I started it up again, this happened again and it crashed again.  How is that similar, and what can I do about it?
73994
So, I'm getting the occasional CAPTCHA message, which is irritating but fine, but occasionally Google just blocks my network wholesale. I've submitted automated requests to unblock it, but I have no idea who I can email directly to clarify the issue.  I've run all manner of anti-virus, parsed my router's logs, combed through Fiddler to see if any errant packets were slipping by. Nothing. The only Google searches that happen are made by me through the web-browser.  Who or what do I have to do to get Google to stop falsely flagging my network as a spam-bot?
66554
I already used Limit Login Attempts wordpress plugin. Are there other ways to prevent brute force attacks?  I'm worried because I saw a lot of locked out.
38301
Users  with freeimagehosting.net are getting SO flagged.  Not sure where else to post this, but I thought I'd let the meta-mongers know. I obviously know it's not an issue personally but it could potentially freak people out.
45023
My site is: . It's build using Wordpress.  My lastest Post is: , after making this post for the last 5 days I'm getting The site ahead contains harmful programs problem.  Because of this I'm getting low traffic.  How do I resolve this issue?  But main site working fine.
13313
I have, in my view, strong, albeit circumstantial, evidence that a particular user is operating a sock puppet account. It appears not to have been detected by any automated mechanisms–both users are still here.  The individual in question is not interested in collecting lots of rep but rather uses the account to carry out prolonged vindictive down-voting attacks. The down-voting account loses rep over time (due to the down-votes) and when it gets close to falling below 125, it is topped up.  Do moderators want to hear more details (e.g. via a flag)? Or do we just accept that if the automated detection scripts don't pick it up, then there's nothing more to be done.
97466
This is kind of a weird request. For some reason whoever owns safeandbuy.com has pointed their domain at my IP address. The reason it's a problem is that I'm having all kinds of crawlers that are trying to crawl my site with that domain name.   Is there anything I can do about this?
73364
I'm going a little nuts here. The entire point of my site resides on the idea of people registering for the site to contribute content. But I get spam accounts created at least once every minute. Im mass deleting these accounts and the content they create every single time I visit my own site.   I currently use  with the CAPTCHA as the default method (not text analysis) and I have text analysis set to every other form across my site, I use the  module set to and properly configured Akismet (had good results from Wordpress), and also have Spamicide enabled and properly configured.   But spam users are still being made in some very insane amounts, and generating content all over my site; which leads me to wonder if they're even using the forms at all any more to generate content on my site..   EDIT  may have been a little paranoia but I changed the user credentials to my database just to be sure. And yeah, user accounts by the dozens still being created..   I just tried out the  module by exposing the form element with Firebug and writing anything in it. Sure enough the form doesn't register the account.   The Captcha works perfectly too.  Note: I understand Captchas is not good enough (Spam bots these days can solve captchas), but its the only option I get from Mollom.
102923
We recently saw that a particular domain (lets say it is recipient.com operated by recipient ltd) of newsletter recipients block our newsletter quite often. Therefore we asked the operating company of that domain what is wrong with our newsletters.  Recipient LTD told us:        Use  and that this is the reason why   our newsletter are regarded as spam or virus and get blocked.   Only refer to valid, trusted URLs in your e-mails and make sure that   there is no risk of confusion. Don't link to a phishing site and don't   quote or forward links to malware or spam. Also not as an example or   for fun!   For security reasons, our servers do not allow unencrypted   transfer of executable formats such as those used by viruses, worms   and Trojans.         Examples: ade, adp, app, asp, bas, bat, bhx, cab, ceo,   chm, cmd, com, cpl, crt, csr, der, exe, fxp, hlp, hta, iframe, inf,   ins, isp, its, js, jse, lnk, mad, maf, mag, mam, mar, mas, matte, mde,   mim, msc, msi, msp, mst, ole, pcd, pif, reg, scr, sct, shb, shs, vb,   vbe, vbmacros, vbs, vsw, wmd, ws, wsc, wsf, wsh and xxe.Because spam or virus sender often use links with ids to cover the real target of that url.          Furthermore we saw that we created every link in our newsletter with https but it gets wrapped like:   http://click.ourdomain.com/?qs=65a074a335071185581e968250a74788b72109cb3c4eec81f11a111eac1696522ec229b01733cb96b9ede10b706c1ae6a688533974ef5952   (we selfhost the dns entries and do not use a subdomain or different domain to send our emails)   The open tracking looks like this:  http://click.ourdomain.com/open.aspx?ffcb10-fec41577776c0078-fe5f1077716c047d7713-fe4615111564047e701470-ff5f17757d-fe5a11727c61027d7217-ffce15  Questions:   How can we configure salesforce to wrap these links in https? Has anybody else experienced problems that the tracking functionality (opens,clicks,...) of newsletters causes block bounces?
63017
We've been out of private beta for only two days, and stackoverflow.com is already ranking high in .  Are there any specific techniques applied in the site? I've been researching the subject for some time and haven't found it to be so easy.   even returns site-links.  ()
112044
Update from Shog9:     Also affects Aviation, Cooking... Probably everything on the "not yet in progress" list here:  - I've passed this on to the devs. – Shog9     The  got busted in the last few hours.  It looks ugly and now needs to be scrolled, see below.  Other review pages (, ) are still fine. And the problem appears for me in both Chrome and Firefox -- and whether or not I'm logged in.        versus:
96474
I know this seems like a good idea, but this far into the game you should be able to tell from network behavior that I'm not a spammer…  I had a compound question. I broke it up because breaking it up was possible—it probably isn't even necessary in that it wouldn't otherwise get closed. Now I doubt either of my questions will be easily answered, but it stinks when you want to run (irl) to have to wait on a question timer which means posting one at a later time. Can't we fight spammers more effectively in a different way?  You know it's my intent to ask the question (or you'd give me a captcha). You also know that historically my questions have been   Can't we find a way to make this not stupid?
116360
This has bothered me for a long time as it puts my sites bounce rate up.  I am based in the UK and my business covers this country and no others, so I have never advertised outside of the UK but for some reason I get 21% of my traffic from Germany.  The German visits all have something in common, they are always direct, they always land on the home page, they never open any other page and the visit never lasts even a second so it gives me reason to think it is some kind of bot?  I really want to stop this so I have try to improve my sites bounce rate but I can't figure out why this is happening.  Below is a picture of my top two countries and you can see how different the visits are from Germany.
84692
Most of my visits are from baidu spiders. I don't think it helps search engines at all so I'm thinking of how to block them. Could this be done via iptables? I'm using nginx as my webserver.
98120
I have been an active user lately on Stack Exchange Mathematics. If anyone can checkout my profile, I have posted my answers along with questions that I asked just to know if I attempted them correctly or not. I've never spammed nor abused anyone. Still I am getting this message.     You can only post 1 time each day due to the volume of spam and abuse   originating from your network.   Is there anything that can be done about this? Can I get help from any moderator?
108077
I just browsed a site a while ago that was flagged as an "attack site" or has malware, but Firefox didn't warn before I went into it. Only when I opened a new tab with another page from the site did it block the page.   How do I check for vulnerabilities on my system since I think there are no anti-malware available for Ubuntu? If there are, please do tell.  Thanks!
62179
Super User got hit by another batch of spammers creating profiles. They've got accounts on other sites from what I've heard from other mods and from the comments here.  Last time it was streaming. Now it's  (as of december, looks like they're spamming scammy finance too). I have 160+ pages of users from that search, and a quick look suggests most of them are spammers. Comments from this post indicates it's network wide - and a quick check indicates Stack Overflow has a handful of these too, though not as many as we have.  While the powers at be have been taking action, both directly, and indirectly, it feels like between shared IPs and search, mods might be able to take a good chunk of these out if we can somehow have a way to delete accounts somewhat in bulk. You guys are awesome. But these... People keep doing it still, and it would be nice to see their works undone.  Unlike our streaming spammers, they've switched to phone numbers, presumably because Adam so kindly blocked links.    There's a few good suggestions at mitigating these - but ideally - I've heard from fellow mods that we want them gone.  They add to the broken window effect - which we can't do anything about due to sheer volume, and they probably poison our search engine results.  We can probably reduce the risk of oops by filtering by IPs (clearing everything on an IP lets me whack, 10, or so users at once, rather than clicking through 3-4 pages a user) and optionally selectively not deleting accounts that seem legit, we can probably clear out a bunch of these without really needing CM intervention. It does make it a little too easy, but these incidents, well kinda need a flamethrower's gentle warmth.  I'm cool with a no. I'm probably going through the usual channels in future. Would be nice to have something that lets mods deal with this effectively though.  Related:    - Actually goes into the impact of this  by a user - so clearly these are discoverable to an average user