All requests come from a dozen IP addresses spread across German and
USA's Amazon AWS hostnames, but since query terms they are using are
not entirely unrelated (they are passing sequences of numbers and
weird full names) to our business I got to think if this is really an
On the face of it, it seems typical of a flood attack using proxy servers and placing repeated or hammer action type requests on your webserver aiming at search terms that will cause the greatest amount of search results, thus consume the most CPU usage as possible of the database server.
The sequence numbers could be as a cache breaking exercise as the problem with using proxy servers is that many of them are caching to the attacker wants every send to be an actual request on your webserver.
An example might be www.yoursite.com/?searchword=aeroplanes&randomfieldname=100001
While the webserver will ignore randomfieldname because it is not looking for it, it will take the value from searchword and apply the request.
A caching proxy however will see the following
as new requests therefore always pass the request through to your server even though the search word has not changed.
This is an example of a hammer attack.
These extra security checks though can be annoying for legimate site viewers, for example image validation.
Although that class was written almost a decade ago, the concepts in it are as valid today as the day they were written, albeit their need to be updated to the latest PHP coding standards.