High Load Average and Excessive Process and DDOS From Bots

Hi,  i wanted to share this experience because it could effect other websites and other installs.  Hopfully it might help someone with the issue without having to pull their hair out.  I dont know if this is a new issue, repeated issue, or expected issue but i have resolved it for the most part so ill share. 

This last week i began getting configserver lfd emails warning of high minute load averages and excessive processes having to do with php cgi, and that http had failed but recovered. Im talking 20 emails in a row like waves of emails.   

At first i would just reboot the server but that did not help.  Looking at the running processes i noticed that my php cgi had double processes and one was 50% and the other was 48% or resources.  Im like wth... 

After some trial and error i figured out it was caused by attempted ddos attack from bots.  These were not normal bots, these were non standard bots which do not follow normal bot protocol.  They use the browser and overload a site, i got 270,000 hits in very little time.  

This was happening on my phpbb forum so i noticed phpbb had a topic open on the matter, here is that topic link.  https://www.phpbb.com/community/viewtopic.php?t=2662519 

If you review that, you might want to start from the last page and work forward as the previous pages have suggested fixes that may or may not work.  

Basically alot of the bots are from singapore, iraq, china, russia, even canada, and germany.  

This is not just a phpbb forum issue, forum software all over the world is battling this wave as well as non forum software.  Which is why i am sharing this here. 

My remedy was to block ip ranges at the forum level.  I would do it at the csf level but with csf going away ill wait to add it to the next software tool i use, whatever that is... 

#bot traffic from singapore causing ddos
Deny from 43.0.0.0/8
Deny from 124.0.0.0/8
Deny from 129.0.0.0/8
Deny from 150.0.0.0/8
Deny from 101.0.0.0/8
Deny from 119.0.0.0/8
Deny from 40.0.0.0/8

#traffic from russia
Deny from 5.0.0.0/8
Deny from 149.0.0.0/8
Deny from 84.0.0.0/8

#traffic from iraq
Deny from 45.157.0.0/16

#traffic from china
Deny from 112.0.0.0/8
Deny from 123.0.0.0/8
Deny from 116.0.0.0/8

#proxy from canada
Deny from 51.222.253.19

I block ranges because i have the luxury of having a very specific niche and i really dont need to worry about doing so as most of my traffic comes from a specific place.  But be warned that blocking ranges like this could block valid customers.  

I guess this wave is comming from something called ali baba bots, whatever those are. 

Any way as i said i just wanted to share because even though this effected my phpbb forum, someone here could be scratching their head wondering wth was going on with their site with another software.  

Dave :)