DDOS сайта. Как бороться?

Пользуюсь услугами Systemintegra. Рекомендую.

Подключите cloudflare.com

Уже стоит. Не помогает. Нужно, чтобы кто-то настроил за оплату. По логам вижу, что ip все очень похожие.

Можно примеры запросов?

141.101.92.122 - - [26/Mar/2015:21:05:49 +0400] "GET //index.php?do=login HTTP/1.1" 301 0 "http://wap.huysosi.cc/))))))))))))((((((((()()()()().php?id----------------[..]

-59>>>>>3485784#G*)@*)%$GB*R)FY#)%GR*FHduis(%$&^$34w78&****&***&URJdfusif78G$*#GBIJFHIDSIFDSBIHISD" "Mozilla/5.0 (Linux; U; Android 1.6; en-us; eeepc Build/Donut) AppleWe

bKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1" "46.147.212.3"

141.101.92.122 - - [26/Mar/2015:21:05:49 +0400] "GET //index.php?do=login HTTP/1.1" 301 0 "http://www.usatoday.com/search/results?q=" "w3m/0.5.1" "46.147.212.3"

141.101.92.122 - - [26/Mar/2015:21:05:49 +0400] "GET //index.php?do=register HTTP/1.1" 301 0 "https://rjUSURJ43867*(4543.com/346j7u9dshUHSDF?phpt5387GTY*ESRFGSOI*T^$(%G

YSAGOFGUOFUASOFGHIOPGPIIPSHGUIP" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SV1; .NET CLR 2.0.50727; InfoPath.2)" "46.147.212.3"

141.101.92.122 - - [26/Mar/2015:21:05:49 +0400] "GET //index.php?do=login HTTP/1.1" 301 0 "http://happy-hack.ru/script.php?id=idinahuycyka&rotebalnahuy)))))" "Mozilla/5

.0 (Macintosh; U; PPC Mac OS X; de-de) AppleWebKit/418 (KHTML, like Gecko) Shiira/1.2.2 Safari/125" "46.147.212.3"

141.101.92.122 - - [26/Mar/2015:21:05:49 +0400] "GET //?T\xF0\xB0 HTTP/1.1" 404 11639 "http://www.usatoday.com/search/results?q=" "Mozilla/4.0 (compatible; MSIE 6.0; Wi

ndows NT 5.1; Avant Browser [avantbrowser.com]; iOpus-I-M; QXW03416; .NET CLR 1.1.4322)" "46.147.212.3"

141.101.92.122 - - [26/Mar/2015:21:05:49 +0400] "GET //index.php?do=register HTTP/1.1" 301 0 "http://www.usatoday.com/search/results?q=" "w3m/0.5.1" "46.147.212.3"

141.101.92.122 - - [26/Mar/2015:21:05:50 +0400] "GET //?\xFF\xF8\xF7\xF4\xF0\xAFv\xF2 HTTP/1.1" 404 11639 "http://wap.huysosi.cc/56nI*Y*R*^$&*88***4788939@)$(U#)%UJTTTT

TTTTTTI4%&*(7*%3925rpfdsjfgp97w324-89&*%(RH(df09#&*%HSD{FHDS)&%$%T&$WERFDS 9((( 88(((()) fd9(D(38290@!!@# e4057trg90" "Mozilla/5.0 (Linux; U; Android 2.1-update1 (7h

ero-astar9.3); ru-ru; HTC Legend Build/ERE27) AppleWebKit/530.17 (KHTML, like Gecko) Version/4.0 Mobile Safari/530.17" "46.147.212.3"

141.101.92.122 - - [26/Mar/2015:21:05:50 +0400] "GET //?\xFB\xFE\xF3\xF8\xFD\xA6\xF0\xA8\xFE\xFB\xB9 HTTP/1.1" 404 11639 "http://www.google.com/?q=" "Mozilla/5.0 (X11;

U; Linux i686 (x86_64); en-US; rv:1.8.1.6) Gecko/20070817 IceWeasel/2.0.0.6-g2" "46.147.212.3"

141.101.92.122 - - [26/Mar/2015:21:05:50 +0400] "GET //?iloveponyandu???MADAFUQA!! HTTP/1.1" 404 11679 "http://wap.huysosi.cc/56nI*Y*R*^$&*88***4788939@)$(U#)%UJTTTTTTT

TTTI4%&*(7*%3925rpfdsjfgp97w324-89&*%(RH(df09#&*%HSD{FHDS)&%$%T&$WERFDS 9((( 88(((()) fd9(D(38290@!!@# e4057trg90" "amaya/9.53 libwww/5.4.0" "46.147.212.3"

141.101.92.122 - - [26/Mar/2015:21:05:50 +0400] "GET //?\xFF\xF8\xF7\xF4\xF0\xAFv\xF2 HTTP/1.1" 404 11639 "http://google.com/?q=34786IDICYDAPADLA+DDDDDxDDDh843697***&&%&

%&$&^&&$^^3e5487*&*$*^$^$^#^gfGBIEFGFIDSF" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100318 Mandriva/2.0.4-69.1mib2010.0 SeaMonkey/2.0.4" "46.147.212

.3"

141.101.92.122 - - [26/Mar/2015:21:05:50 +0400] "GET //?\xFF\xF8\xF7\xF4\xF0\xAFv\xF2 HTTP/1.1" 404 11639 "http://www.usatoday.com/search/results?q=" "Mozilla/5.0 (X11;

U; Linux i686 (x86_64); en-US; rv:1.8.1.6) Gecko/20070817 IceWeasel/2.0.0.6-g2" "46.147.212.3"

141.101.92.122 - - [26/Mar/2015:21:05:50 +0400] "GET //?\xFB\xFE\xF3\xF8\xFD\xA6\xF0\xA8\xFE\xFB\xB9 HTTP/1.1" 404 11639 "http://www.google.com/?q=HHHHHHHHHHHHHHHHHHHHH

HHHUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUYNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACYKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA////>><<.php" "ELinks (0.4pre5; Linux 2.4.27 i686;

80x25)" "46.147.212.3"

141.101.92.122 - - [26/Mar/2015:21:05:50 +0400] "GET //?id=DDDDDDOSSSSATTTACCKkkK&@CTIV@T3D=trashtrashtrash HTTP/1.1" 500 620 "http://400kg.com/loadhuy.php?huy=556&targ

et=ticyka&mission=ebat" "Mozilla/5.0 (SymbianOS/9.1; U; en-us) AppleWebKit/413 (KHTML, like Gecko) Safari/413" "46.147.212.3"

ДДОС с 1 IP? Серьёзно?

WorldsBig, это не похоже на ддос, у меня примерно тоже самое. Осенью уже была волна, эта, похоже, вторая. Важный вопрос - метрика стоит?

Их там куча.

значит теперь переключите cloudflare в режим "I ' am under attack" .

fail2ban, не? )

Сервер под нагрузку настраивали, или "изкоробочное" решение?

Вижу HTTP флуд.