Timeline for Prevent a bot accessing login page with multiple IPs and massive list of username/ passwords
Current License: CC BY-SA 4.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 29, 2020 at 16:25 | comment | added | thkala | 50K different IPs from a single customer of one ISP? Having the equivalent of a /16 network allocation is fairly expensive - in the order of $5 per IP, IIRC - so I would not expect an attacker to shell out that kind of money, not with their name attached on it. It seems more likely that the client got totally owned and is now hosting a botnet. | |
| Aug 28, 2020 at 10:53 | comment | added | Simon Richter | You'd make a WHOIS query for one of the IP addresses, either through the ICANN web form or with the command line tool, which is a lot more convenient if you want to do multiple queries. For Linux, it is available from your distribution, for Windows, you can get one from SysInternals. | |
| Aug 27, 2020 at 21:10 | comment | added | contool | Unfortunately they are using a LOT of different IPs, I've counted over 50k in the last few hours. I did reach out to their ISP directly and they identified the "client" by IP so I issued a cease and desist. Out of interest, how would one go about determining the range or block of IPs assigned to an ISP? We do use some out of the box firewall countermeasures provided by AWS in WAF - specifically their own IP reuptation blacklists, but unfortunately none of these IPs have been flagged before. | |
| Aug 27, 2020 at 11:35 | review | First posts | |||
| Aug 27, 2020 at 13:06 | |||||
| Aug 27, 2020 at 11:34 | history | answered | Logronoide | CC BY-SA 4.0 |