Question DDoS Attack on Plesk Server +

[issjenuw]

Server operating system version

almalinux

Plesk version and microupdate number

18

I have been facing a huge DDoS attack against my Plesk server, which hosts around 250 accounts. The attacks were causing very high load and making several websites slow or completely inaccessible

I recently installed BashEdge plugin for plesk on the server, and so far it has been working great. It is blocking a large amount of the attack traffic and the server has remained stable. I have attached a screenshot of the attack statistics.

I do have one question. Most of my domains are already behind Cloudflare. If I enable BashEdge Lockdown Mode during a heavy attack, could it cause any issues with Cloudflare traffic or accidentally block/challenge Cloudflare IPs?

Has anyone used Cloudflare together with BashEdge Lockdown Mode?

 

[issjenuw]

forgot to attach screenshot

 

[TorbHo]

Are you sure it’s a DDoS attack? 250 hosts seems very low.

We recently had similar issues caused by a hacked website.

Check this guide:

https://support.plesk.com/hc/en-us/articles/12377282594199-How-to-diagnose-a-DoS-DDoS-attack-and-find-websites-under-attack-on-a-Plesk-server

Also, check whether the targeted website contains any suspicious or malicious files.

 

[King555]

250 hosts seems very low.

I guess he means 250 websites are on his server, not 250 bots attacking it.

 

[TorbHo]

@King555 That's correct. I misread that. Nevertheless, I would still check whether my assumption is correct and which domain the attack is targeting, so that we can recommend further measures.

 

[issjenuw]

Exactly. The attack stopped completely after enabling the plugin. the question is they have an Lockdown mode and i am using it with cloudflare under attack mode. will it cause any conflict ?

 

[WebHostingAce]

Exactly. The attack stopped completely after enabling the plugin. the question is they have an Lockdown mode and i am using it with cloudflare under attack mode. will it cause any conflict ?

Yes, Cloudflare Under Attack Mode can be quite aggressive and may challenge legitimate traffic as well, including search engine bots such as Googlebot.

If the attack has already stopped after enabling the plugin, I would consider disabling Cloudflare Under Attack Mode and using a more targeted custom Security rule instead.

For example:

(ip.geoip.country ne "AU") and
not cf.client.bot

This is only an example and should be adjusted depending on where your legitimate visitors are coming from.

I would also check the bot activity in Cloudflare. It may be worth looking specifically at AI crawlers, as some of the traffic could be coming from bots scraping content from the website. Some AI bots, such as meta-externalagent, can be particularly aggressive.

I haven’t used BashEdge myself, so I can’t really comment on that part.