r/webhosting • u/thatandyinhumboldt • 6d ago
Advice Needed Is anyone else seeing wide-scale SQL injection attacks?
I host a number of sites for my clients, and over the past few days, I've been seeing a ton of attack attempts, across all of my sites. I'm pretty used to the normal noise, so it wasn't surprising that everything started ramping up after the latest WordPress CVEs, for example. However, I'm getting a lot of SQL injection style attacks as well--way more than background noise, and hitting all of my sites around the same time (or more accurately, consistently).
Is anyone else seeing this (i.e., it's a broad-scale campaign), or is it limited to me?
8
u/Accomplished-Web6183 5d ago
those are automated scripts by script junkies, trying every know vulnerabilities, even for HTML websites. One thing is put it behind Cloudflare, it stops all that hitting directly. Atleast you can stop worring about.
My logs are filled with those, but all my sites are behind cloudflare, safe to an extent.
1
u/thatandyinhumboldt 5d ago
Yeah cloudflare has been helping, but some of them are even getting through that. I also have a couple of sites that can’t be on cloudflare for various reasons, and they’re just drowning
1
5
u/harrymurkin 5d ago
Widescale everything attacks. ai bots going door to door with a run book for every type of website, plugin, platform.
5
u/mooter23 5d ago
It's not just you. Have been hosting on an enterprise scale for the last decade and the past year or so has just been mental for malicious traffic. We had to create new firewall rules just to deal with the volume of spam, which has been effective, but it's unrelenting. Around 2/3 of traffic to our servers is malicious now, and if you don't block it, you end up paying for it. But it's the noise that drives me insane, thousands of IPs just trawling for low level vulnerabilities, taking resources away from legitimate traffic in the process. I'm not sure how the story ends, but I reckon it'll get worse before it gets better.
3
u/rob94708 5d ago
Hundreds of thousands of IPs. Fucking residential proxies. You can’t block by source anymore.
1
u/thatandyinhumboldt 5d ago
Yeah I have been hosting for a while and there’s always a certain noise floor, but it’s getting higher. I host tiny sites (think the local little league), and I’m seeing tens of millions of requests a month.
I agree—probably 2/3 of it is just bots doing drive-by checks for unpatched systems.
4
u/PartySunday 5d ago
The future of web hosting seems to be that basically everyone will have an auto-hacking superweapon LLM. Hopefully we will also get auto-defending superweapons soon.
2
u/skynetcoder 5d ago
An attacker has to be lucky only once, the defender has to be lucky all the time. so even if defenders has a super weapon, it will still be an unbalanced game.
2
1
u/mbeshkin 4d ago
I cache generated html files and proxy by Nginx. Even search results are cached this way. So, backend and database interaction is minimum
I see an enormous flow of browser-based requests. And these are coming from big data centers. They consume traffic, but otherwise my setup can handle such amount of requests.
1
u/Old_Hamster1264 2d ago
Vibe coded scanners going crazy 🤣
They just looking for vulnerable sites to dump, nothing special.
21
u/dasfoo 5d ago
Sadly, one of the benefits of AI is that you no longer need to be remotely smart or clever to become a hacker. You can more or less vibe-hack your way into locating software vulnerabilities and making a nuisance of yourself. I've also seen a sharp rise in the # and effectiveness of attacks in the last few weeks.