change the cgi name from search to something else, and update the templates accordingly. Automate this to change the name every week, using a variable in the templates.

The best strategy is to block old Chrome versions (< 135) connections with no referrer that does /search directly. Works very well against this botnets. You can do it in Apache with:

RewriteCond %{HTTP_USER_AGENT} Chrome/([1-9][0-9]?|1[0-2][0-9]|13[0-5])\. [NC]
RewriteCond %{REQUEST_URI} ^/cgi/search [NC]
RewriteCond %{HTTP_REFERER} ^$
RewriteRule .* - [F]

People with old browsers just go to the home page, then in search, so you get 99,99999 of the valid traffic.

CAUTION: This e-mail originated outside the University of Southampton.

CAUTION: This e-mail originated outside the University of Southampton.

Hello.

Dear all,

We are experiencing repeated bot attacks targeting the Advanced Search functionality on our EPrints repository. The bots generate a large number of requests to /cgi/search/archive/advanced, causing high server load and affecting our repository's availability.

As an immediate mitigation, we have:

• Placed the repository behind a Web Application Firewall (WAF).
• Temporarily disabled the Advanced Search feature.

Our repository is now accessible again, but we would like to know whether anyone in the community has experienced a similar issue.

We would appreciate any recommendations on any best practices for protecting the Advanced Search endpoint from bots, etc.

Thank you in advance.

*** Options: https://wiki.eprints.org/w/Eprints-tech_Mailing_List
*** Archive: https://www.eprints.org/tech.php/
*** EPrints community wiki: https://wiki.eprints.org/