title: Relentless Server DDoS attacks on all admin opencart
body: <p>We have a rather difficult case of attacks on our VPS server</p>
  <p>(CLOUDLINUX 7.9 kvm [web] v98.0.9)
  Server Version: Apache/2.4.51 (cPanel) OpenSSL/1.1.1l Apache mod_bwlimited/1.4</p>
  <p>mainly in the form:</p>
  <pre><code>http/1.1    example-domain.com:443    POST /admin/ HTTP/1.1
  </code></pre>
  <p>that target the admin section of opencart installations in the server (~40 accounts).</p>
  <p>Example:</p>
  <div class="s-table-container">
  <table class="s-table">
  <thead>
  <tr>
  <th>Srv</th>
  <th>PID</th>
  <th>Acc</th>
  <th>M</th>
  <th>CPU</th>
  <th>SS</th>
  <th>Req</th>
  <th>Dur</th>
  <th>Conn</th>
  <th>Child</th>
  <th>Slot</th>
  <th>Client</th>
  <th>Protocol</th>
  <th>VHost</th>
  <th>Request</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>0-5</td>
  <td>26445</td>
  <td>0/358/943</td>
  <td>_</td>
  <td>717.80</td>
  <td>15</td>
  <td>250</td>
  <td>768524</td>
  <td>0.0</td>
  <td>9.62</td>
  <td>20.16</td>
  <td>xx.xx.xx.xx</td>
  <td>http/1.1</td>
  <td>exampledomain.comm:443</td>
  <td>POST /admin/ HTTP/1.1</td>
  </tr>
  </tbody>
  </table>
  </div>
  <p>we have csf v14.11, mod security with GotRoot rules, but attacks cannot be stopped.</p>
  <p>we are also trying to block the attacks as per account editing the admin script to give</p>
  <p>Code:
  HTTP/1.0 403 Forbidden
  for these attacks.</p>
  <p>Any ideas or pointers?</p>