Question DDoS Attack on Plesk Server +

[issjenuw]

Server operating system version

almalinux

Plesk version and microupdate number

18

I have been facing a huge DDoS attack against my Plesk server, which hosts around 250 accounts. The attacks were causing very high load and making several websites slow or completely inaccessible

I recently installed BashEdge plugin for plesk on the server, and so far it has been working great. It is blocking a large amount of the attack traffic and the server has remained stable. I have attached a screenshot of the attack statistics.

I do have one question. Most of my domains are already behind Cloudflare. If I enable BashEdge Lockdown Mode during a heavy attack, could it cause any issues with Cloudflare traffic or accidentally block/challenge Cloudflare IPs?

Has anyone used Cloudflare together with BashEdge Lockdown Mode?

 

[issjenuw]

forgot to attach screenshot

 

[TorbHo]

Are you sure it’s a DDoS attack? 250 hosts seems very low.

We recently had similar issues caused by a hacked website.

Check this guide:

https://support.plesk.com/hc/en-us/articles/12377282594199-How-to-diagnose-a-DoS-DDoS-attack-and-find-websites-under-attack-on-a-Plesk-server

Also, check whether the targeted website contains any suspicious or malicious files.

 

[King555]

250 hosts seems very low.

I guess he means 250 websites are on his server, not 250 bots attacking it.

 

[TorbHo]

@King555 That's correct. I misread that. Nevertheless, I would still check whether my assumption is correct and which domain the attack is targeting, so that we can recommend further measures.

 

[issjenuw]

Exactly. The attack stopped completely after enabling the plugin. the question is they have an Lockdown mode and i am using it with cloudflare under attack mode. will it cause any conflict ?