Is it just me?

[edge]

I have a .net domain and for the past week the script kiddy and dos attacks are 4x what they were prior to that. Unsophisticated and ineffectual, but annoying. Anyone else seeing this in their IDS logs?

 

[Serverking]

@edge So its a domain or website?

 

[edge]

Domain. I also host a couple of web sites, but the script kiddies are hitting the ip with the usual dumb password attacks on ssh which isn't exposed. I expect to get hit by the script kiddies about 4 to 8 times a day, lately it has gone up to 12 to 20 times. The sites are getting hit with about a 1.5x higher rate of malformed packets than usual.

 

[Serverking]

Few more questions:

1. Is this attacker using just one IP or multiple IPs?

2. Are the IPs from one ASN like AS16276 ovh?

Few solutions could be installing fail2ban to rate limit and block the IP, you could also null route all the attacking ASNs.

Another choice is ignore as you don't have any exposed ssh ports.