• caglararli@hotmail.com
  • 05386281520

How to handle Microsoft FTP server being DDoSed

Çağlar Arlı      -    18 Views

How to handle Microsoft FTP server being DDoSed

We noticed FTP service going down intermittently in the server and we found an FTP user was used to DDoS the server. Then we deleted the specific user from the server. After that the user "anonymous" was hitting the server with 1000s of connections as seen here https://prnt.sc/JtCx7n1ok3Xv . Things we have tried so far

  1. IIS manager -> FTP site -> FTP authentication and disabled anonymous authentication
  2. IIS manager -> FTP site -> FTP authorization rule and added a deny rule for "All anonymous users"
  3. Located the anonymous user MSFTP7_023979 and disabled it
  4. Removed the user MSFTP7_023979 permission for the FTP site folder

But still getting connections from anonymous user. Is there a way to block all FTP connections from anonymous user?