Floods and connection exhaustion against Linux servers
An address sending requests or connections faster than any client would (HTTP floods, SYN and UDP floods, connection exhaustion), and that the agent blocked while the flood was running.
The observatory is not answering just now. The numbers are rebuilt every hour; try again shortly.
What a block for this reason means
An address sending requests or connections faster than any client would (HTTP floods, SYN and UDP floods, connection exhaustion), and that the agent blocked while the flood was running.
Why it happens to every server
A flood does not need a vulnerability; it needs bandwidth, and bandwidth is cheap. Most of what reaches a small server is a side effect of something else: a misconfigured client, a scanner in a hurry, or a botnet testing what it can reach.
What to do about it
A web server with sensible connection limits, a firewall that can rate-limit, and monitoring that notices a flood before the site does. SecAI's agent blocks a flooding address on the server itself, in approval mode or automatically.
How to read these figures
- Blocks, not attempts. An attack SecAI did not block is not counted, so these are floors.
- A small fleet. A handful of servers. The number of servers is next to every figure because it is part of what the figure means.
- No addresses, countries or ports. The address is used to count distinct sources and then dropped; the rest is not recorded on a block.
How this data is collected and what is left out · All categories
Also published: SSH password guessing, Web scanning and probing, WordPress abuse.
Free to reuse with credit (CC BY 4.0). Cite as: SecAI Threat Observatory, Floods and connection exhaustion, https://secai.techsteps.ae/threats/floods. The same counts are in the JSON at https://secai.techsteps.ae/api/public/threats, rebuilt hourly.
Questions
Not enough of it on the servers SecAI monitors to publish a figure: a category is published only once it has been seen on several servers with enough events to be anonymous.
One block: an address the agent blocked on a customer's server for this reason, and confirmed it had blocked. Distinct addresses are counted separately, because one address can be blocked many times.
No. The published tables hold counts by day and category. The attacker's address is used to count distinct sources and then discarded; no customer address, hostname or server identifier is stored or served, and a day or category seen on too few servers is withheld.
Is your server in this already?
The free assessment reads how your server is set up and tells you what an attacker would find, in about a minute, without changing anything.