DDoS attack from ukmacau.com

  • Unknown's avatar
    martinoei · Member ·

    I am the owner of martinoei.com, a website is using wordpress.org. I found a blog is using wordpress.com services to attack my site as Pingback DDoS.

    Here is the record from my access.log

    192.0.87.217 – – [08/Sep/2018:00:28:41 +0000] ‘HEAD /article/21311/%E7%9A%87%E5%AE%B6%E6%B5%B7%E8 HTTP/1.1’ 301 5467 ‘https://martinoei.com/article/21311/%E7%9A%87%E5%AE%B6%E6%B5%B7%E8’ ‘WordPress.com; http://ukmacau.com’
    192.0.87.217 – – [08/Sep/2018:00:28:41 +0000] ‘GET /article/21311/%E7%9A%87%E5%AE%B6%E6%B5%B7%E8 HTTP/1.1’ 301 6316 ‘https://martinoei.com/article/21311/%E7%9A%87%E5%AE%B6%E6%B5%B7%E8’ ‘WordPress.com; http://ukmacau.com’
    192.0.87.217 – – [08/Sep/2018:00:28:42 +0000] ‘GET /article/21311/%E7%9A%87%E5%AE%B6%E6%B5%B7%E8%BB%8D%E8%88%87%E8%A7%A3%E6%94%BE%E8%BB%8D-%E5%8D%97%E6%B5%B7-%E5%B0%8D%E5%B3%99 HTTP/1.1’ 200 47900 ‘https://martinoei.com/article/21311/%E7%9A%87%E5%AE%B6%E6%B5%B7%E8%BB%8D%E8%88%87%E8%A7%A3%E6%94%BE%E8%BB%8D-%E5%8D%97%E6%B5%B7-%E5%B0%8D%E5%B3%99’ ‘WordPress.com; http://ukmacau.com’
    192.0.87.217 – – [08/Sep/2018:00:28:42 +0000] ‘HEAD /article/17951/%E9%A6%99%E6%B8%AF%E5%8D%8A%E5%B9%B4%E5%A0%B1%E5%91%8A%EF%BC%9A-%E4%B8%80%E5%9C%B0%E5%85%A9%E6%AA%A2-%E5%8D%B3%E4%BF%82%E5%BA%95%E7%B7%9A HTTP/1.1’ 200 5467 ‘https://martinoei.com/article/17951/%E9%A6%99%E6%B8%AF%E5%8D%8A%E5%B9%B4%E5%A0%B1%E5%91%8A%EF%BC%9A-%E4%B8%80%E5%9C%B0%E5%85%A9%E6%AA%A2-%E5%8D%B3%E4%BF%82%E5%BA%95%E7%B7%9A’ ‘WordPress.com; http://ukmacau.com’
    192.0.87.217 – – [08/Sep/2018:00:28:42 +0000] ‘GET /article/17951/%E9%A6%99%E6%B8%AF%E5%8D%8A%E5%B9%B4%E5%A0%B1%E5%91%8A%EF%BC%9A-%E4%B8%80%E5%9C%B0%E5%85%A9%E6%AA%A2-%E5%8D%B3%E4%BF%82%E5%BA%95%E7%B7%9A HTTP/1.1’ 200 35041 ‘https://martinoei.com/article/17951/%E9%A6%99%E6%B8%AF%E5%8D%8A%E5%B9%B4%E5%A0%B1%E5%91%8A%EF%BC%9A-%E4%B8%80%E5%9C%B0%E5%85%A9%E6%AA%A2-%E5%8D%B3%E4%BF%82%E5%BA%95%E7%B7%9A’ ‘WordPress.com; http://ukmacau.com’
    192.0.87.217 – – [08/Sep/2018:00:28:47 +0000] ‘HEAD /article/21311/%E7%9A%87%E5%AE%B6%E6%B5%B7%E8 HTTP/1.1’ 301 5467 ‘https://martinoei.com/article/21311/%E7%9A%87%E5%AE%B6%E6%B5%B7%E8’ ‘WordPress.com; http://ukmacau.com’
    192.0.87.217 – – [08/Sep/2018:00:28:47 +0000] ‘HEAD /article/21311/%E7%9A%87%E5%AE%B6%E6%B5%B7%E8%BB%8D%E8%88%87%E8%A7%A3%E6%94%BE%E8%BB%8D-%E5%8D%97%E6%B5%B7-%E5%B0%8D%E5%B3%99 HTTP/1.1’ 200 5467 ‘https://martinoei.com/article/21311/%E7%9A%87%E5%AE%B6%E6%B5%B7%E8%BB%8D%E8%88%87%E8%A7%A3%E6%94%BE%E8%BB%8D-%E5%8D%97%E6%B5%B7-%E5%B0%8D%E5%B3%99’ ‘WordPress.com; http://ukmacau.com’
    192.0.87.217 – – [08/Sep/2018:00:28:48 +0000] ‘HEAD /article/17951/%E9%A6%99%E6%B8%AF%E5%8D%8A%E5%B9%B4%E5%A0%B1%E5%91%8A%EF%BC%9A-%E4%B8%80%E5%9C%B0%E5%85%A9%E6%AA%A2-%E5%8D%B3%E4%BF%82%E5%BA%95%E7%B7%9A HTTP/1.1’ 200 830 ‘https://martinoei.com/article/17951/%E9%A6%99%E6%B8%AF%E5%8D%8A%E5%B9%B4%E5%A0%B1%E5%91%8A%EF%BC%9A-%E4%B8%80%E5%9C%B0%E5%85%A9%E6%AA%A2-%E5%8D%B3%E4%BF%82%E5%BA%95%E7%B7%9A’ ‘WordPress.com; http://ukmacau.com’

    192.0.116.202 – – [08/Sep/2018:00:40:14 +0000] ‘HEAD /article/17951/%E9%A6%99%E6%B8%AF%E5%8D%8A%E5%B9%B4%E5%A0%B1%E5%91%8A%EF%BC%9A-%E4%B8%80%E5%9C%B0%E5%85%A9%E6%AA%A2-%E5%8D%B3%E4%BF%82%E5%BA%95%E7%B7%9A HTTP/1.1’ 200 5467 ‘https://martinoei.com/article/17951/%E9%A6%99%E6%B8%AF%E5%8D%8A%E5%B9%B4%E5%A0%B1%E5%91%8A%EF%BC%9A-%E4%B8%80%E5%9C%B0%E5%85%A9%E6%AA%A2-%E5%8D%B3%E4%BF%82%E5%BA%95%E7%B7%9A’ ‘WordPress.com; http://ukmacau.com’
    192.0.116.202 – – [08/Sep/2018:00:40:14 +0000] ‘GET /article/17951/%E9%A6%99%E6%B8%AF%E5%8D%8A%E5%B9%B4%E5%A0%B1%E5%91%8A%EF%BC%9A-%E4%B8%80%E5%9C%B0%E5%85%A9%E6%AA%A2-%E5%8D%B3%E4%BF%82%E5%BA%95%E7%B7%9A HTTP/1.1’ 200 39925 ‘https://martinoei.com/article/17951/%E9%A6%99%E6%B8%AF%E5%8D%8A%E5%B9%B4%E5%A0%B1%E5%91%8A%EF%BC%9A-%E4%B8%80%E5%9C%B0%E5%85%A9%E6%AA%A2-%E5%8D%B3%E4%BF%82%E5%BA%95%E7%B7%9A’ ‘WordPress.com; http://ukmacau.com’
    192.0.116.202 – – [08/Sep/2018:00:40:15 +0000] ‘HEAD /article/21304/%E8%8B%B1%E5 HTTP/1.1’ 301 5467 ‘https://martinoei.com/article/21304/%E8%8B%B1%E5’ ‘WordPress.com; http://ukmacau.com’
    192.0.116.202 – – [08/Sep/2018:00:40:16 +0000] ‘GET /article/21304/%E8%8B%B1%E5 HTTP/1.1’ 301 6352 ‘https://martinoei.com/article/21304/%E8%8B%B1%E5’ ‘WordPress.com; http://ukmacau.com’
    192.0.116.202 – – [08/Sep/2018:00:40:16 +0000] ‘GET /article/21304/%E8%8B%B1%E5%9C%8B%E6%9C%80%E6%96%B0-%E9%A6%99%E6%B8%AF%E5%8D%8A%E5%B9%B4%E5%A0%B1%E5%91%8A-%EF%BC%9A%E9%83%BD%E4%BF%82%E5%94%94%E5%A4%A0%E7%A1%AC HTTP/1.1’ 200 39343 ‘https://martinoei.com/article/21304/%E8%8B%B1%E5%9C%8B%E6%9C%80%E6%96%B0-%E9%A6%99%E6%B8%AF%E5%8D%8A%E5%B9%B4%E5%A0%B1%E5%91%8A-%EF%BC%9A%E9%83%BD%E4%BF%82%E5%94%94%E5%A4%A0%E7%A1%AC’ ‘WordPress.com; http://ukmacau.com’

    I demand wordpress.com to suspend the related domain services for their bad behaviour

    The blog I need help with is: (visible only to logged in users)

  • supernovia · Staff ·

    Hi @martinoei, actually it looks like they just linked to a few different articles on your site. The pingbacks (which are different from constant pinging in way we typically think of with DDoS attacks) came in close together because there were multiple links in each article, however that should have been the end of it.

    If their linking to your site like this is truly causing strain on your server, can you report the site here?
    https://wordpress.com/abuse/

  • The topic ‘DDoS attack from ukmacau.com’ is closed to new replies.