I've been getting hit everyday with 50-100M calls to my API and I'm trying to identify the subnets that are the sources.
I found by running a match in redis (where all requests from the last 24hrs get logged), matching the first part eg.
40.140.* in redis I found hundreds of matches! That is hundreds of ips all starting with
I thought I could use this as a signal of whether or not a particular group of ips were malicious, but I've also found about 200 ips from what looks like my local network, that is ips with the first
x.x matching my home network.
Why am I seeing all these ips from the same subnet in my logs? Including some seemingly from my own local network?
This is trying to figure out if a particular subnet is a source of malicious traffic based on the fact that we have a lot of calls from the same subnet. There are tens of thousands more ip addresses making requests.