IIS 5 & IIS 6
Bombarded with iisstart.htm requests - Need Help ::: URGENT
Last post Jun 05, 2012 11:06 AM by peterviola
May 13, 2012 11:38 PM|SantoshK|LINK
I am observing at my webserver's iislog that there are couple of IP addresses which are making multiple calls in every 2-3 milliseonds to IIS page /iisstart.htm. I am looking a work around to stop this.
I tried two things so far to trap this bombardment of iisstart.htm requests .
1. Removed iisstart.htm from defualt documents list from IIS. Now in the iis log , those distinct IPs are still hitting my webserver with blank request and getting 403.
2. Blocked those IP from directory security in IIS properties. Still results are same as step 1. Those distinct IPs are still hitting my webserver with blank request and getting 403.
Please help me getting outta it... it's significantly reducing the server's performance.
May 14, 2012 07:55 AM|fab777|LINK
it's significantly reducing the server's performance.
Jun 05, 2012 11:06 AM|peterviola|LINK
Turn on Windows Firewall if you aren't using it already and then block the IPs in question or talk to your hosting provider to block them.
I imagine this is no longer an issue but here's a great Logparser script to quickly identify the top 10 IPs that are hitting your site in case you need to block any again.
logparser.exe "select Top 10 count(*), c-ip from logfile.log group by c-ip order by Count(*) DESC" -o:csv >c:\temp\topIP.txt