Stop a DOS/Script attack ?

2025-04-07

Other than making my site login only, keycode or phpsession

Does anyone know of a way to stop this script attack .......

For 5 days now my site Whois-Search.com has been under attack. The guy is doing 50,000 searches a day.

I've had to shut my site down but the attack is still going.

See the 1 minute of Log below

Every ip is a proxy ip

The guy is scripting 2 domains a second

You can't block the ips because he keeps changing it.

208.252.22.130 - - [19/Oct/2003:00:01:30 +0100] "GET /results/?query=bobsfarms.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 98)"
80.17.14.170 - - [19/Oct/2003:00:01:30 +0100] "GET /results/?query=hotsyalberta.com HTTP/1.1" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; SiteCoach 1.0)"
12.254.83.68 - - [19/Oct/2003:00:01:32 +0100] "GET /results/?query=katherinetoubiandds.com HTTP/1.1" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)"
200.84.222.102 - - [19/Oct/2003:00:01:32 +0100] "GET /results/?query=barrysanders.net HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
202.103.41.2 - - [19/Oct/2003:00:01:33 +0100] "GET /results/?query=newcombart.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
195.169.25.2 - - [19/Oct/2003:00:01:35 +0100] "GET /results/?query=frogs-legs.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 98)"
213.152.93.4 - - [19/Oct/2003:00:01:36 +0100] "GET /results/?query=wwwpaddingtonstationriding.com HTTP/1.1" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
211.75.39.154 - - [19/Oct/2003:00:01:40 +0100] "GET /results/?query=mike-april-wedding.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)"
12.104.92.8 - - [19/Oct/2003:00:01:40 +0100] "GET /results/?query=freelandftmyers.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"
200.47.100.7 - - [19/Oct/2003:00:01:45 +0100] "GET /results/?query=gosnakes.com HTTP/1.1" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
210.220.73.24 - - [19/Oct/2003:00:01:46 +0100] "GET /results/?query=hkdea.com HTTP/1.1" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)"
212.72.11.84 - - [19/Oct/2003:00:01:50 +0100] "GET /results/?query=vedicastroindia.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"
211.124.28.40 - - [19/Oct/2003:00:01:51 +0100] "GET /results/?query=reartz.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"
203.199.49.77 - - [19/Oct/2003:00:01:51 +0100] "GET /results/?query=sara-press.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)"
151.173.163.6 - - [19/Oct/2003:00:01:52 +0100] "GET /results/?query=unitedoil-indonesia.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)"
65.66.145.225 - - [19/Oct/2003:00:01:59 +0100] "GET /results/?query=humanityinart.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
66.255.188.131 - - [19/Oct/2003:00:02:01 +0100] "GET /results/?query=paulfranciswillmott.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
61.132.90.4 - - [19/Oct/2003:00:02:02 +0100] "GET /results/?query=clioassembly.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)"
67.116.155.181 - - [19/Oct/2003:00:02:08 +0100] "GET /results/?query=northeastcopy.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
200.163.190.115 - - [19/Oct/2003:00:02:08 +0100] "GET /results/?query=frontdoorflowers.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
80.191.232.80 - - [19/Oct/2003:00:02:08 +0100] "GET /results/?query=artchaoui.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)"
62.49.123.162 - - [19/Oct/2003:00:02:10 +0100] "GET /results/?query=katherinetoubiandds.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Q312461)"
211.250.187.129 - - [19/Oct/2003:00:02:10 +0100] "GET /results/?query=donnaflenniken.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)"
195.241.77.162 - - [19/Oct/2003:00:02:11 +0100] "GET /results/?query=shaysrebellion.net HTTP/1.1" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
80.58.4.44 - - [19/Oct/2003:00:02:12 +0100] "GET /results/?query=lakespeed.net HTTP/1.1" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
202.138.137.38 - - [19/Oct/2003:00:02:15 +0100] "GET /results/?query=aaaalldale.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
195.249.40.245 - - [19/Oct/2003:00:02:16 +0100] "GET /results/?query=mickmackey.net HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)"
195.117.55.100 - - [19/Oct/2003:00:02:17 +0100] "GET /results/?query=hotsyalberta.com HTTP/1.1" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
208.206.234.83 - - [19/Oct/2003:00:02:17 +0100] "GET /results/?query=madmonkproductions.com HTTP/1.1" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)"
203.89.133.250 - - [19/Oct/2003:00:02:18 +0100] "GET /results/?query=bupperts.com HTTP/1.1" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
67.116.155.181 - - [19/Oct/2003:00:02:18 +0100] "GET /results/?query=amrazo.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
200.30.165.138 - - [19/Oct/2003:00:02:20 +0100] "GET /results/?query=urnes-mira.com HTTP/1.1" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)"
208.29.180.114 - - [19/Oct/2003:00:02:21 +0100] "GET /results/?query=ccttrain.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90) via proxy gateway CERN-HTTPD/3.0 libwww/2.17"
80.255.41.201 - - [19/Oct/2003:00:02:22 +0100] "GET /results/?query=ruanns.com HTTP/1.1" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
61.88.121.4 - - [19/Oct/2003:00:02:23 +0100] "GET /results/?query=danddbakersfield.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 95; DigExt)"
217.207.42.66 - - [19/Oct/2003:00:02:26 +0100] "GET /results/?query=enerconpanels.com HTTP/1.0" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
202.152.77.28 - - [19/Oct/2003:00:02:28 +0100] "GET /results/?query=mahainc.com HTTP/1.1" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
80.58.33.235 - - [19/Oct/2003:00:02:29 +0100] "GET /results/?query=ryukyukempo.net HTTP/1.1" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)"
203.89.133.250 - - [19/Oct/2003:00:02:29 +0100] "GET /results/?query=atlantavelo.com HTTP/1.1" 200 686 "http://www.whois-search.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"