I have a home network, big family, with around 20 devices on it at any given time. It seems like every year or so, some device gets a virus or a security flaw is revealed, and the device starts behaving badly.
Normally the device will behave badly and try to password crack my network folders etc.
But the latest thing we have experienced this year is that the affected device will start firing off 1000's of requests to some site. Afterwards, I get on a DDOS ban list. For example, I can at this time not access
- https://aa.com/ ... and more.
An answer below has helped me understand that this is due to Akamai Tecnhologies blocking my IP. I called Akamai Tecnhologies and they confirmed this and let me know that my IP was suspected as "Web Scraping." Meaning some sort of malware must have made tons of web requests to site(s) protected by Akamai Tecnhologies and therefore got flagged as a DDoS attacker. Not necessarily malware, it could have been some rogue software issue that caused these excessive requests too. I have contacted them trying to get the exact sites it hit so that I can debug further.
This sucks because my ISP does not allow me to change my IP address so I'm stuck banned.
I have my router's QoS feature turned on and I do not see any suspicious network behavior at this time. But that could change at any given moment.
So now the question:
What methods are there to identify this situation so that I can take immediate action?
Namely, I need a way to get an alert when my home network has suddenly become a DDOS attack node. Ideally something could be attached to the router to send me a notification - "hey device IP 192.168.1.x just started making 1000's of requests to sites so I have blocked its access until you take action."
So far this is what I have done:
- See How do I know if my computer is being used for a botnet-based DDoS attack?
- Changed all passwords, set up 2factor authentication on all password manager sites, etc.
- Formatted all the windows laptops with fresh copies of windows, because Windows has a higher tendency to have viruses.
- Virus scanned my whole network.
- Block all TCP/UDP traffic to any devices that are meant to be used in local intranet only. Such as my security cameras and android tablets that monitor those cameras.
- Anti-virus software on each device, make sure software updates are kept up to date, etc.
- Make sure no one but me has admin access of devices. All user accounts on each computer are restricted to just what that person needs.
I'm using a netgear R9000 router. Do you think there are any REST/SOAP api web services that I can use to create a simple program that watches for DDoS attack patterns?