I had a similar problem, not with web, but with mail. Thousands of incoming delivery attempts to addresses of the type <randomletters>@mydomain.com. It saturated my connection so I had to do something drastic to get legitimate connections through.

Doing the analysis, it turned out that in most cases I only got few from each IP, in some cases mails were directed through a proxy and more attempts were registered.

So, I created a script carefully looking up in whois (whois.cyberabuse.org), creating a database of ips and net ranges. If only one ip in a block offended me, only that got blocked, but if more got on the list, the whole range was blocked. This worked! I got my connection back.

Now, I didn't go back and carefully look at the ranges I had blocked, even though my database also included abuse addresses etc.

A month later, I had forgot all about it, I submitted an application for a new organisation for internet security established the government (I shall not disclose which in order not to embarass them in public). I didn't get an answer, it turned out that they used the same mail relay as some compromised government hosts...

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/350/32301#32301