# 🚨 IMMEDIATE ACTIONS - Block Attack Now

## IP to Block: **41.44.117.225**

This IP is flooding `/api/products/search?q=t` and exhausting all PHP-FPM workers.

---

## Option 1: Block via Apache .htaccess (FASTEST)

```bash
# SSH to server
ssh user@your-server

# Edit .htaccess
sudo nano /var/www/html/sellzaki.com/production/public/.htaccess

# Add at the TOP of the file:
<RequireAll>
    Require all granted
    Require not ip 41.44.117.225
</RequireAll>

# Save (Ctrl+X, Y, Enter)
# No reload needed - .htaccess is read on every request
```

**Result**: IP blocked immediately, before reaching PHP.

---

## Option 1B: Block via Apache Config (RECOMMENDED)

```bash
# Create blocked IPs file
sudo nano /etc/apache2/conf-available/blocked-ips.conf

# Add:
<RequireAll>
    Require all granted
    Require not ip 41.44.117.225
</RequireAll>

# Save and enable
sudo a2enconf blocked-ips
sudo apache2ctl configtest
sudo systemctl reload apache2
```

**Result**: IP blocked at Apache level, cleaner than .htaccess.

---

## Option 2: Block via Laravel (if nginx not accessible)

```bash
# SSH to server
ssh user@your-server

# Navigate to project
cd /var/www/html/sellzaki.com/production

# Block IP for 24 hours
php artisan security:block-ip 41.44.117.225 --minutes=1440
```

**Result**: IP blocked at application level.

---

## Option 3: Block via Firewall (PERMANENT)

```bash
# Block at firewall level
sudo ufw deny from 41.44.117.225

# Or using iptables:
sudo iptables -A INPUT -s 41.44.117.225 -j DROP
```

**Result**: IP completely blocked from accessing server.

---

## Step 2: Restart PHP-FPM (Free Workers)

```bash
# Check PHP version
php -v

# Restart PHP-FPM (replace 8.2 with your version)
sudo systemctl restart php8.2-fpm

# Verify it's running
sudo systemctl status php8.2-fpm
```

**Result**: All stuck workers are killed and restarted.

---

## Step 3: Deploy Security Fixes

```bash
cd /var/www/html/sellzaki.com/production

# Pull latest code
git pull origin main

# Clear Laravel caches
php artisan cache:clear
php artisan config:clear
php artisan route:clear

# No frontend rebuild needed (backend-only changes)
```

**Result**: 
- Product search now requires minimum 2 characters
- Aggressive rate limiting: 10 requests/minute per IP
- Auto-blocking for abusive patterns

---

## Step 4: Monitor (Optional)

```bash
# Watch for the blocked IP trying to access
sudo tail -f /var/log/apache2/sellzaki-access.log | grep "41.44.117.225"

# Watch for new abusive IPs
sudo tail -f /var/log/apache2/sellzaki-access.log | awk '{print $1}' | sort | uniq -c | sort -rn

# Check PHP-FPM worker count
ps aux | grep php-fpm | wc -l

# Check Apache status
sudo systemctl status apache2
```

---

## Verification

After blocking, test that legitimate users can still search:

```bash
# Test from your IP (should work)
curl -H "Authorization: Bearer YOUR_TOKEN" \
  "https://tyson.sellzaki.com/api/products/search?q=test"

# Should return products, not 403/429
```

---

## If Attack Continues from Different IPs

This might be a distributed attack. Consider:

1. **Cloudflare**: Enable "I'm Under Attack" mode
2. **Rate limiting**: Already deployed (10 req/min for search)
3. **CAPTCHA**: Add for repeated searches
4. **Geo-blocking**: Block countries if attack is localized

---

## Rollback (if something breaks)

```bash
# Remove IP block from Apache
sudo nano /etc/apache2/conf-available/blocked-ips.conf
# Delete the Require not ip line, save

# Reload Apache
sudo systemctl reload apache2

# Or remove from .htaccess
sudo nano /var/www/html/sellzaki.com/production/public/.htaccess
# Delete the RequireAll block

# Or unblock via Laravel
php artisan security:unblock-ip 41.44.117.225
```

---

## Contact

If you need help, check:
- Laravel logs: `tail -f storage/logs/laravel.log`
- Apache logs: `tail -f /var/log/apache2/sellzaki-error.log`
- PHP-FPM logs: `tail -f /var/log/php8.2-fpm.log`
- mod_evasive logs: `tail -f /var/log/apache2/mod_evasive/*`