1

I've been getting hit everyday with 50-100M calls to my API and I'm trying to identify the subnets that are the sources.

I found by running a match in redis (where all requests from the last 24hrs get logged), matching the first part eg. 40.140.* in redis I found hundreds of matches! That is hundreds of ips all starting with 40.140.*.*

I thought I could use this as a signal of whether or not a particular group of ips were malicious, but I've also found about 200 ips from what looks like my local network, that is ips with the first x.x matching my home network.

Why am I seeing all these ips from the same subnet in my logs? Including some seemingly from my own local network?

EDIT

This is trying to figure out if a particular subnet is a source of malicious traffic based on the fact that we have a lot of calls from the same subnet. There are tens of thousands more ip addresses making requests.

1

A typical ddos doesn't work on this way. It is in this name: distributed denial of service. If they are coming from the same subnet, they can be called hardly distributed.

However, it is the typical case which can be answered on a by-case basis. For example, if you would be a sysadm of the SE and you would get voting activities in this pattern, the result would be likely a network ban on the subnet.

Check the logs. What are they doing? So can you decide.

  • This is one case from tens of thousands of ips, they're all making single GET requests to the api. – Jonathan May 27 '18 at 21:46
  • @Jonathan What if this GET query is coming from some ajax code which activates on all page loads? Only you can decide it, you should check for the details. But yes, this looks really nasty. But what if this network belongs to an ISP which likes to give new IPs to its customers regularly? Then it is possible, that there is only a single end-user behind the activity, who simply forgot to close a regularly refreshing browser window. Only you can decide this, based exactly on the details what you didn't share here. – peterh - Reinstate Monica May 27 '18 at 21:51
  • Thanks, all I really have is the ips and whether or not they were made with an api key, I'm examining the ones not associated with a key. What gets me is one ip will make 10k+ calls and the other 100 or so ips from the same subnet will make only 1, including what I'm seeing with my own isp, even though I'm not auto-refreshing the page I have the api open. It's a real headache figuring this out. – Jonathan May 27 '18 at 22:00
1

Who owns 40.140.X.X

The block is owned by Windstream Communications LLC, who own the range 40.128.0.1 - 40.143.255.254 source.

Is this a DDoS

It's unlikely, unless the botnet was built from an exploit only attacking routers supplied by this one ISP you would expect a mix of ISPs.

Likely causes

  • A user may be writing an API client which is scraping large amounts of data
  • A user may be using a badly written client, which is needing to make lots of calls to get a small amount of information.
  • An attacker may be making large amounts of bogus queries to hide valuable ones in the noise.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.