小记网站被DOS大量消耗资源的解决方案

今天下午有段时间访问量蛮大的，我的网站居然被攻击了，开始Dramhost的服务员以为我的wordpress效率太底导致负载过大，Dramhost的服务员告诉我：

I am writing you to let you know I was forced to disable the domain ‘zuola.com’ as it was causing too many php processes to be spawned a second and it was bogging down your web server. When I got to your web-server ‘washington’ it had a 200 load. After 10 minutes of disabling your site it was down to 2 and was continuing to drop.

我屏蔽了今天对插所做的改动，然后Dramhost的服务员还是告诉我有些IP的访问量异常，

Things are looking better but you are still causing a bit of load on the server(nothing like before). This might be simply because your site is also getting a lot of traffic right now. It looks like there might be some people abusing your site though as out of the last 20,000 requests 6-7,000 of them were made by only 4-5 IPs. You might want to add a deny from <ip> in your .htaccess file for these types of abusive IPs:

我就用Dramhost的服务员提供的访问查哪些IP的访问太勤快：
washington: 03:41 AM# tail -n 20000 access.log | awk ‘{print $1}’ | sort | uniq -c | sort -n | tail -n 20

然后在根目录的.htaccess里加

deny from 211.147.253.250
deny from 211.138.155.229
deny from 218.56.62.167
deny from 60.4.83.120

Dramhost的服务员告诉我这这个反DOS(Denial of Service 拒绝服务)的方法不错，记录一下分享一下。

我突然觉得，DOS也是一个不错的公关方法，哪家网站骂你，你就去D人家服务器，挺好。今天这D我的王八蛋导致我少了些流量，我猜不出是哪个王八蛋。

BTW:真有五毛来了，[email protected]老在我网站用124.225.15.223这个IP发这个http://news.qq.com/a/20080630/000850.htm　里的内容。这个五毛肯定是奉命的，不过不太敬业，直接COPY了事。

BTW:我家乡的派出所正副所长也打来电话问候了，真的是没有恶意，可能是昨天进瓮安县的半路上被登记身份证号码了，然后今天瓮安国安打电话去煤炭坝镇核实我的身份吧。

今天下午还上传了李树芬验尸报道和李秀华申请刑侦破案书

下载 http://www.zhoushuguang.com/download/yanshibaogao.zip
也可在线查看的相关照片 http://picasaweb.google.com/iamzola/TPQgFB/

http://docs.google.com/View?docid=dhskngnq_6c4z28fdg 这个文档不是我做的，请作者看到我这篇BLOG后邀请我加入编辑，我能更新很多链接进去，我的消息比一般网民灵通。

更新：我弄错了DDOS(Distribated Denial-of-service 分布式拒绝服务)攻击和DOS（Denial of Service 拒绝服务)攻击的区别，感谢明月星光的纠正：）