I have a website that is being hit with invalid URL requests by thousands of distinct IP addresses, never the same one used twice. Most of them are in a few ranges of IP addresses and often just go up sequentially.
Could this be a zombie botnet of compromised devices, or is it possible the attacker is spoofing these addresses?
The clustering of IP addresses into a handful of ranges seems inconsistent with what I would expect from random devices across the world being compromised and part of a botnet.
User agents are all legitimate and quite varied, but I know that is simple to spoof.
It doesn't feel like a DDOS attack as it is "just" a few thousand per hour. If they really wanted to DDOS it seems like they would crank the volume up more. Once I adjusted some exception handling I was able to get my server to resume being responsive to legitimate use.
I suspect it is a malicious (poorly constructed) crawler/spider.
Is IP address spoofing easily done and common now in these scenarios?