Unable to access the website using HTTPS, the page will load but you're unable to authenticate.

Brute force attacks typically involve repeated login attempts using automated scripts, while DDoS attacks flood the system with excessive traffic to exhaust resources. These attacks can originate from multiple IP addresses, often distributed across various geographic regions, and may result in:

Excessive HTTP requests logged by IIS
High volumes of simultaneous network connections
Service unavailability (503 errors)
Elevated CPU and network usage

To determine if your MOVEit system is under attack, follow these steps:

• Check IIS Log File Sizes
  Navigate to the IIS log directory (e.g., C:\inetpub\logs\LogFiles\).
  Compare the size of the current MOVEit site log (e.g., W3SVC1) with other logs in the same folder.
  A significant increase in log size may indicate abnormal traffic volume.
• Analyze Network Connections
  Open Command Prompt as Administrator.
  Run:
  netstat -an > C:\netstat.txt
  Open netstat.txt and review the IP addresses.
  Look for a high number of connections.
  Identify connections from multiple countries.
  Note any symmetrical or repeating IP address patterns.
• Monitor System Health
  503 Errors: Check IIS or MOVEit logs for service unavailability errors.
  CPU Usage: Use Task Manager or Performance Monitor to identify spikes.
  Network Usage: Use Resource Monitor or a network monitoring tool to detect unusual traffic.

If you suspect an attack but cannot immediately mitigate it, consider the following temporary measures:

• Block Suspicious IPs: Use Windows Firewall or your network firewall to block known malicious IP addresses.
• Enable Rate Limiting: IIS has some capabilities in its Dynamic IP Restrictions (DIPR) module
• Geo-blocking: Restrict access from countries not relevant to your operations.
• Notify your IT security team for further investigation and assistance.