VPS getting nailed by foreign ip addresses.. help


#1

On Tuesday, the CPU usage of my VPS went to over 90%. All of my sites have slowed down considerably and are hardly accessible. I have run tail -f -q /home//logs//http/access.log and get a continuous scroll of foreign IP addresses. There are hundreds or maybe thousands of them continuously hitting my VPS.

How can I stop this? Is my IP address being targeted? If the IP address of my VPS was changed… Would that stop this attack?

I found this article, but it seems to be for IP addresses that you cannot lookup;
http://wiki.dreamhost.com/Block_IP_Abuse

I’m getting like 100 - 200 hits a minute. Here is just a snip of the log. IP addresses are from places like India, United Arab Emirates and Iran.

49.206.143.115 - - [06/Sep/2013:14:30:16 -0700] “POST / HTTP/1.1” 301 315 “-” "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
66.249.66.83 - - [06/Sep/2013:14:30:19 -0700] “GET /media/1/images/e/1709857658934040_1.jpg HTTP/1.1” 302 528 “-” "Googlebot-Image/1.0"
2.51.164.26 - - [06/Sep/2013:14:30:13 -0700] “POST / HTTP/1.1” 301 315 “-” "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
190.222.12.28 - - [06/Sep/2013:14:30:16 -0700] “POST / HTTP/1.1” 301 315 “-” "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
188.159.45.20 - - [06/Sep/2013:14:30:17 -0700] “POST / HTTP/1.1” 301 315 “-” "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
2.134.161.119 - - [06/Sep/2013:14:30:14 -0700] “POST / HTTP/1.1” 301 315 “-” "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
89.28.14.35 - - [06/Sep/2013:14:30:19 -0700] “POST /?s=google HTTP/1.1” 200 228 “-” “Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3”