huge amount of suspect traffic - need help to stop

[MattG]

Hi,

I have this one page on my site which is suddenly getting thousands of hits per hour where it would usually get 1000s per week.

Because of this I knew it was suspect so created a new mysql table to record the info of everyone that went on it as they did. I saw from that data that most of the traffic is coming from different ips/hostnames in Austria and being referred via a link in the english Wikipedia.

So what I did was put something into the page that if they get referred from wikipedia it goes to a different static page (via Header('Location: blabla.html')) to show a message instead of going to the intended page yet I'm still getting the huge amount of traffic (seemingly all from austria) and still recording the referrer as wikipedia which is impossible as it redirects on the first two lines if it detects the traffic being referred from wikipedia.

To me it looks like someone is using some kind of script/application to continually load up this one page while using a fake referring address but still getting through to the intended page.

Does anyone know what this could be and how I could stop it. It seems very suspect to me and possibly a hacker trying to bring down the site by continually loading/reloading the page. Or am I just being overly cautious/wrong?

[NogDog]

Not my area of expertise, but one thing I know is that if it is a hacker, the HTTP_REFERER header is easily spoofed, so by itself it cannot really be depended upon when it comes to security issues.

[MattG]

Since I refer all traffic from wikipedia to another page it definitely looks like the HTTP_REFERER header is being spoofed because that's still being recorded when it shouldn't.

The only thing I can think is referring them based on the visitor's country (in this case if it comes from Austria refer it to the static page) but I wouldn't know the first place to start with that.

[NogDog]

I think that would have to be by IP address range. You could grab $_SERVER['REMOTE_ADDR'] and parse its value, maybe grabbing the first two or three parts via explode() and comparing them to a list us suspect IP ranges.

[NogDog]

PS: That might be better done at the Apache level. I think you could do a redirect via .htaccess based on the requesting IP address.

[MattG]

Thanks NogDog, I'll look into that