3

So I woke up today, and checked my Firewall Events on CloudFlare for my website like I do normally. Most of the time I'll just see thousands of failed SQL injection attempts, but this morning I was confused when I saw nearly 20,000 requests all coming from different IPs sending random GET requests with random values to my login page, here's an example of what it looked like.

attackexample1 attackexample2 attackexample3 attackexample3

Ever single request from the 20,000 had different GET parameters with different values set.

My best bet would be this was a failed DDoS attack, what do you think?


Here's a list of the most common ASN's used from these requests if anyone is interested in adding them to their firewall

45899, 7713, 9299, 17974, 42298, 7552, 24086, 12849, 23969, 132199, 9770, 8708, 55699, 133481, 27699, 45758, 3215, 9121, 4788, 17552

And some of the useragents (separated by ||)

Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02 || Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36 || Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36 || Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 || Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36 || Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8 || Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36 || Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1 || Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1

And some of the most commonly used IPs from the requests

14.234.151.201, 113.172.242.246, 89.211.211.191, 113.161.61.186, 36.84.231.11, 213.57.127.146, 110.138.92.187, 116.97.53.203, 27.76.100.72, 36.38.55.91
  • @camp0 from multiple IPs? – schroeder Nov 14 '18 at 11:57
  • an invalid login shouldn't cause enough CPU/RAM usage to DOS you, especially from just 20k connections – dandavis Nov 14 '18 at 17:13
  • @dandavis Around a week ago the same IP range sent over 650,000,000+ requests, over 500k pps & over 1.7TB of data within a 3 hour time frame, which WAS a DDoS attack. The bots were added to my firewall and couldn't reach over 20,000 requests this time. This more than likely is a network of bots people can purchase for various tasks, DDoS being one, and website scanning another. I actually got in contact with the person that attempted to DDoS my website last week he contacted us, he said it was the Medusa Botnet. Right after talking to him he proved it was him by launching another attack. – rflxdev Nov 15 '18 at 14:52
5

This is almost certainly not a DDoS attack. The 1.10.188.0/24 block is a residential IP block in Thailand. A large number of the IP addresses in that range are known for forum spam. You can read a report for one of the IPs in your logs here.

The weird parameters look like cache busters. By putting random words on the end it makes the request unique and prevents an old (cached) result from being returned. A lot of sites and tools use cache-busting for various things. My guess is that they're hitting sites all over the internet to look for forums and other chat features that they can then send spam messages to.

  • The reason the IPs were blocked by my Firewall isn't because of the strange GET requests, but because I added a Firewall rule blocking that specific IP range and their user agents around a week ago because my website was hammered with over 650,000,000+ (reaching 500,000 pps at times) requests from the same IP range and sent over 1.7TB of data within 3 hours, which ALMOST took my website offline. Though this time there weren't as many requests (only around 20,000) which is why I didn't automatically assume it was a DDoS attack. But yeah thanks for the info. – rflxdev Nov 14 '18 at 11:31
  • 1
    It certainly looks like that range is engaged in some less-than-polite activity, so I wouldn't be surprised if they were running DDoS for hire too. It could also have just been that their spam tools broke and hammered your site without intending to DDoS you at all. Ultimately I wouldn't worry too much about it. The internet is a noisy place and life is too short! Block and move on :) – Polynomial Nov 14 '18 at 11:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.