Blog · A series
Know your attacker
Every public server meets the same attackers. One article per attack: what it wants, how it works, what it looks like in your logs, the settings that stop it — and, plainly, what Demerzel does about it and what it leaves to someone else.
- Slowloris and slow HTTP attacks: taking a server down one byte at a time How Slowloris, R.U.D.Y. and slow-read attacks exhaust Apache and nginx workers with almost no bandwidth, how to spot them with ss and server-status, and the timeouts that stop them.
- When your own ban takes the site down A firewall ban stops an address's new packets, not the connections it already holds. How a fail2ban ban froze every Apache worker on one of our servers, and the two settings that prevent it.
- HTTP floods: when every request is valid and there are too many An HTTP flood sends perfectly valid requests to your most expensive pages until PHP and the database give up. What it looks like in your logs and metrics, and the caching, rate limits and CDN rules that absorb it.
- SYN floods and volumetric DDoS: what your server can stop, and what it can't SYN floods exhaust the kernel's half-open queue; amplification attacks fill the link itself. How each shows up on a Linux host, what SYN cookies and sysctl can do, and why a full pipe is your provider's job.
- Vulnerability scanners and secret probes: who is asking for your .env Every public server is asked for /.env, /.git/config and wp-login.php within hours of going online. What these scanners want, what they find, and how to make sure the answer is always a 404.
- Brute force and credential stuffing: SSH and login forms Password guessing against SSH and credential stuffing against login forms: what each looks like in auth logs and access logs, the sshd and fail2ban settings that end the first, and what it takes to resist the second.
- Aggressive crawlers and scrapers, AI bots included: throttle or ban? Search engines, SEO tools, AI crawlers and scrapers can load a server like an attack without meaning harm. How to recognise them, what robots.txt can and cannot do, and why throttling usually beats banning.
- Exploiting known vulnerabilities: the race between the advisory and your patch Once a vulnerability is public, bots scan for it within days. How mass exploitation of known CVEs works, what the probes look like, and how to shrink the time between a fix being published and your server running it.
See the attacks your servers already log.
Install the agent, let it read your web and SSH logs, and Demerzel shows who is hitting each server and whether it hurt the service.
14-day free trial · No credit card required