GoAdmio
GoAdmio Documentation

DDoS Attack

From the GoAdmio knowledge base.

DDoS Attack

This page explains the DDoS Attack screen in GoAdmio. It detects IPs that are currently generating abnormal traffic patterns and lets you block them directly — helping you mitigate an active Distributed Denial of Service attack in real time.

Location: Admin Panel → Security → DDoS Attack
Location (User Panel): Security → DDoS Attack (if enabled for the account)


Overview

A DDoS (Distributed Denial of Service) attack floods a server or website with requests from many IPs at once, exhausting resources (CPU, memory, connections) and making the service unavailable to legitimate visitors.

The DDoS Attack page is GoAdmio's live mitigation tool. It:

  • Detects IPs that are currently generating abnormal traffic patterns — high request rates, connection floods, or repeat requests
  • Shows the source IP, its country, the visitor count, and the User-Agent
  • Lets you block the offending IPs directly from the page, without switching to IP Blocker
Unlike IP Blocker (which is manual) and Bot Blocker (which is User-Agent based), this page focuses on current, active attacks and gives you a fast response workflow.

> Note: The page shows 0 records when no active attack is detected. An empty list is normal — it means the server is not currently under a detectable attack.


What the Page Shows

| Column / Field | Description |
|---|---|
| IP | The source IP address generating the traffic |
| Country | The country of the IP (from GeoIP) |
| Visitor No. | The number of requests or visits from that IP |
| Browser | The detected browser (Chrome, Firefox, etc.) |
| User Agent | The full User-Agent string sent by the client |
| Search | Filter the list by IP, country, or User-Agent |
| Footer | Showing 0 of 0 records — total IPs detected |

> Tip: The Visitor No. column is the most important — the highest counts are the most likely attack sources. Sort by it descending to see the worst offenders first.


How to Respond to an Active DDoS Attack

Step 1 — Review the list

  1. Log in to the GoAdmio Admin Panel.
  2. Navigate to Security → DDoS Attack.
  3. Review the detected IPs.
Look for patterns:

| Pattern | Likely attack type |
|---|---|
| One IP with very high request count | Single-source flood |
| Many IPs with moderate counts | Distributed (botnet) attack |
| One country with many IPs | Geographically-targeted attack |
| All IPs share the same User-Agent | Automated bot attack — also try Bot Blocker |
| All IPs share the same browser | Automated bot attack |

Step 2 — Block the source IPs

From the DDoS Attack page:

  1. Locate the offending IP(s).
  2. Click Block (or select the IPs and use Block Selected).
  3. Confirm.
The IPs are blocked immediately. They are added to the IP Blocker list and can be reviewed or removed there later.

> Warning: Blocking an IP takes effect immediately, but an active attack may continue from other IPs. Continue reviewing the list until the traffic drops.

Step 3 — Consider a broader mitigation

If the attack is distributed across many IPs (a botnet), blocking individual IPs is slow. Consider:

| Option | When to use |
|---|---|
| Country Whitelist | If the attack originates from a few countries |
| Bot Blocker | If all attacking IPs share a User-Agent |
| CDN / WAF | Large-scale attacks; a CDN absorbs traffic at the edge |
| Firewall-level blocking | For very large attacks, block at the network level |
| Contact hosting provider | For volumetric attacks exceeding the server's bandwidth |

Step 4 — Monitor the site

After blocking:

  1. Confirm the site loads normally.
  2. Check Apache Status for request volume.
  3. Check Process Monitor for CPU and memory.
  4. Check View Bandwidth Usage for traffic spikes.

Understanding the Columns

Visitor No.

The number of requests or visits from the IP during the detection window.

| Value | Interpretation |
|---|---|
| 1–50 | Normal traffic — likely a legitimate visitor |
| 50–500 | Elevated — could be a scraper, bot, or aggressive client |
| 500–5,000 | Suspicious — likely automated, may be part of an attack |
| 5,000+ | Almost certainly an attack source |

> Tip: The exact thresholds depend on your server's normal traffic. A small site may be under attack at 500 requests; a busy site may be normal at 5,000.

Browser and User Agent

The client's claimed identity.

| Pattern | Meaning |
|---|---|
| Real browser UA (Chrome, Firefox, Safari) | Could be a legitimate visitor — or a bot spoofing a browser |
| Generic UA (python-requests, curl, wget, aiohttp) | Almost always a bot or script |
| Empty UA | Almost always a bot |
| Old or unusual UA | Bot or scanner |
| Same UA from many IPs | Botnet |

> Tip: If many IPs share the same unusual User-Agent, Bot Blocker or Bot Manager may be faster than IP-by-IP blocking.

Country

The GeoIP-detected country of the IP.

> Note: GeoIP accuracy varies. VPNs, proxies, and cloud providers can report a different country than the user's actual location. See Country Whitelist for caveats.


How DDoS Detection Works

GoAdmio monitors incoming requests and detects anomalies based on:

  • Request rate per IP — how many requests an IP makes in a short window
  • Connection rate — how fast an IP opens connections
  • Error rate — how many requests fail (a signature of scanning and fuzzing)
  • User-Agent patterns — repeated identical User-Agents across many IPs
  • Behavioral patterns — automated request sequences that human visitors do not produce
When an IP exceeds the thresholds, it is listed on the DDoS Attack page.

> Note: The exact thresholds are configured by GoAdmio and may not be adjustable in the panel. If you need finer control, use a CDN/WAF.


Verifying the Attack

Check Apache Status

```bash

Open the Apache Status page in the panel


Look for a spike in active requests and worker state (W)

↑