Mitigating High Volume Distributed Attack on Port 443 Targeting GET?POST /moodlee/index.php

[wpf]

I'm experiencing a distributed attack targeting port 443 on my server. The attack has these characteristics:

1. Originates from numerous random IP addresses
2. Automatically rotates IPs when blocked
3. Target requests consistently begin with "GET /moodlee/index.php?" followed by varying parameters
4. Uses what appears to be a botnet with millions of IPs

What I've tried

1. Implemented configuration connection rate limiting (2/sec) in LiteSpeed
2. Applied similar limits in CSF firewall
3. Activated CAPTCHA verification

All these measures have proven ineffective because:

1. The attack distributes requests across millions of IPs
2. New IPs immediately replace blocked ones
3. Traffic floods the webserver despite CAPTCHA being active

Question

What would be an effective approach to block this distributed attack at the firewall level before it reaches my webserver? I believe filtering at the server firewall level would be most effective, but I need specific implementation guidance.

Environment

1. Web server: LiteSpeed
2. Firewall: CSF
3. Almalinux 8

If there is someone who can help configuration and provide a solution I would be very grateful.

 

[abk]

Have you verified reCAPTCHA being triggered? What is the Trigger Sensitivity for reCAPTCHA Protection? Make sure it's set to 100.
We have extensive docs going into more details on the steps you can take to protect your server/website: https://docs.litespeedtech.com/lsws/cp/cpanel/antiddos/

 

[wpf]

Have you verified reCAPTCHA being triggered? What is the Trigger Sensitivity for reCAPTCHA Protection? Make sure it's set to 100.
We have extensive docs going into more details on the steps you can take to protect your server/website: https://docs.litespeedtech.com/lsws/cp/cpanel/antiddos/

Alright, reCAPTCHA is triggered and the block is working, but since the attack persists, LiteSpeed is struggling to handle these requests. LiteSpeed is overloaded handling millions of random IP attacks.

[3523862] [T0] [103.166.159.163:32778:HTTP2-1#APVH_domain.com:443] [RECAPTCHA] Reason: over vhost conn limit.

I have configure access log path in the litespeed admin console => Log, but In the access_log 0KB i can see detail every ip