site under attack

Forum Moderators: phranque

Message Too Old, No Replies

site under attack

seamus

6:46 am on Mar 14, 2015 (gmt 0)

Hi guys,
My site is being bombarded with by requests that errors and cause it to crash on a daily basis. Lines from the error log look like this

[Mon Mar 09 15:05:45 2015] [error] [client 121.205.200.106] DBD::mysql::st fetchrow_hashref failed: fetch() without execute() at lib/pm.lib line 1157., referer: http://www.example.com/cgi-bin/example/pm.

I've changed the address of the scripts they are targeting which seems to offer temporary relief, but I'm sure they will catch up with me again.

I'm looking for some tips on how to deal with this.
All the offending IPs are from china.
I haven't been able to block the ip's from a .htaccess (i think because they are targeting the cgi-bin which isn't in the root directory)

Is there any programs that can detect malicious behaviour and ban ip's automatically,
If so, are they hard to install and configure?

Any help or suggestions appreciated.

[edited by: phranque at 11:42 am (utc) on Mar 14, 2015]
[edit reason] exemplified domain [/edit]

not2easy

3:45 pm on Mar 14, 2015 (gmt 0)

What do you see in your access logs? That should give you some ammunition to block their access to the cgi-bin. BTW, the URL in the example shown above says your cgi-bin is is the root directory, your htaccess file should have no problem to prevent them from ever hitting your cgi-bin.

Please note that blocking their access does not mean they will go away right away, if it is programmed activity (bot) it may stop when they notice repeated and continued failure.

Usually this type of question is seen in the Apache Forum: [webmasterworld.com...] where some good help with htaccess can be found in the Charter, the Library and daily discussions.

aakk9999

10:27 pm on Mar 14, 2015 (gmt 0)

My site is being bombarded with by requests that errors and cause it to crash on a daily basis.
[Mon Mar 09 15:05:45 2015] [error] [client 121.205.200.106] DBD::mysql::st fetchrow_hashref failed: fetch() without execute() at lib/pm.lib line 1157., referer: http://www.example.com/cgi-bin/example/pm.

What you have is unhandled exception. This means that your script is not handling well what is thrown at it.

Personally, I would fristly fix the script so that the script does not return the error that then causes the site to crash.

What are these Chinese IPs throwing at your script that caused it to return the error? Can you trap these and return "403 forbidden" or "404 Not Found" or some other error when your script receives something that is not expected?

Also, see this thread on WebmasterWorld - it is old but it may be relevant:
fetchrow_arrayref failed: fetch() without execute() [webmasterworld.com]