Attack to same url

[Deepblue]

Hello,
I am getting an attack to an url and its always the same. It make loads over 50% and make my site unable to access.
I have ddos protection and waf enabled but still nothing seems to be working.
What shall i do, please give me an idea?
SS from ssh:

 

[Pong]

How did you setup DDoS protection and enable waf? Can you show more details?

 

[Deepblue]

How did you setup DDoS protection and enable waf? Can you show more details?

Our hosting company offering ddost protection. I asked from them to put our ip behind their firewall and they did it. I am not sure what is their firewall confugration look like.
Also i have CSF and Mod Security enabled. + I've enabled waf thgrough LS settings. I didnt do anything special just enabled.
Then i did what this guide says except the last step because i dont know how to create a virtual host and what to enter to those inputs:
https://www.litespeedtech.com/support/wiki/doku.php/litespeed_wiki:config:mitigating-ddos-attacks

 

[Pong]

1.
LSWS built in per connection throttling feature should help you to block IP if over connections.

Static Requests/second    40
Dynamic Requests/second    2
Outbound Bandwidth (bytes/sec)    0
Inbound Bandwidth (bytes/sec)    0
Connection Soft Limit    15
Connection Hard Limit    20
Block Bad Request    Yes
Grace Period (sec)    15
Banned Period (sec)    60

You can evern lower setting to meet you need.

2.
You should also enable cache for your application. Cache doesn't help you to block attach, but it can mitigate the attack dramatically. Our Wordpress benchmark shows:
Using the LiteSpeed Cache Plugin for WordPress with LSWS easily handled close to 5,200 requests per second.
It could resolve your server load issue.

 

[Deepblue]

1.
LSWS built in per connection throttling feature should help you to block IP if over connections.

Static Requests/second 40
Dynamic Requests/second 2
Outbound Bandwidth (bytes/sec) 0
Inbound Bandwidth (bytes/sec) 0
Connection Soft Limit 15
Connection Hard Limit 20
Block Bad Request Yes
Grace Period (sec) 15
Banned Period (sec) 60
You can evern lower setting to meet you need.

2.
You should also enable cache for your application. Cache doesn't help you to block attach, but it can mitigate the attack dramatically. Our Wordpress benchmark shows:
Using the LiteSpeed Cache Plugin for WordPress with LSWS easily handled close to 5,200 requests per second.
It could resolve your server load issue.

1. Already done but has no any effect on this attack.
2. What confugration you suggest for cace?
Btw i am not using wp, we have a vbulletin forum.

 

[NiteWave]

is /forum/index.php a normal URL ? or normal URL should be /forum/ only ?
if so, you can try put following rule on top of .htaccess:

RewriteEngine On
RewriteRule forum/index.php - [F,L]

see if it's effective to mitigate the attack.

 

[Deepblue]

is /forum/index.php a normal URL ? or normal URL should be /forum/ only ?
if so, you can try put following rule on top of .htaccess:
RewriteEngine On
RewriteRule forum/index.php - [F,L]
see if it's effective to mitigate the attack.

This is content of index.php:

define('VB_REDIRECT', true);

/**
 * If you want to move this file to the root of your website, change the
 * line below to your vBulletin directory and uncomment it (delete the //).
 *
 * For example, if vBulletin is installed in '/forum' the line should
 * state: define('VB_RELATIVE_PATH', 'forum');
 *
 * Note: You may need to change the cookie path of your vBulletin
 * installation to enable your users to log in at the root of your website.
 * If you move this file to the root of your website then you should ensure
 * the cookie path is set to '/'.
 *
 * See 'Admin Control Panel
 *    ->Cookies and HTTP Header Options
 *      ->Path to Save Cookies
 */

//define('VB_RELATIVE_PATH', 'forum');

// Do not edit anything below //
if (defined('VB_RELATIVE_PATH'))
{
    chdir('./' . VB_RELATIVE_PATH);
}

require('forum.php');

And forum.php at the attachment because its too long.
index.php require forum.php and forum.php is mainpage of forum.

 

[Deepblue]

This rule not effective unfortunately:

RewriteEngine On
RewriteRule forum/index.php - [F,L]

but....
Enabling private cache from LS confugration sort solved the issue. It lowered loads to 3% from 70%-80% and this is more than enough for now
Thank you very much guys.