1

We run an API service. We gave our customer a package for max limit of 12000 API calls / day. He reported to us that a user has been on purposely visiting his web page 12,000 times a day in order to max it out. We checked the logs and blocked that IP. A few days later, the attacks came again, this time, from 50 different IPs around the world, w/ new ones popping as soon as we ban them. The customer suspects it's his competitor trying to force him to spend more money. This has been going on for 2 months. He should probably get better DDoS protection but what are some good ways to solve this on our end?

Improve this question
2
  • 1
    How do your client, and their web site visitors interact with you? Does your client's web server communicate with you, so their visitors never communicate with you directly? Or do their visitors make direct requests to your web servers, presumably with an API token?
    – paj28
    Feb 3, 2014 at 10:33
  • As asked above, we would need to understand how exactly the end-user communicates with your API service in order to answer you correctly.
    – ack__
    Feb 21, 2014 at 15:44

3 Answers 3

Reset to default
1

You could also look into implementing some form of velocity control. A quick google shows this article http://www.codinghorror.com/blog/2009/02/rate-limiting-and-velocity-checking.html which does a reasonable job of describing it.

There are some things to watch out for when rate limiting, generally better to get progressively slower at responding rather than hard error, but watch for DOS attacks. I typically implement an overall velocity control, and smaller limits subsets, such as a single IP address or identical requests for same data

Improve this answer
0

If it wouldn't impair the user experience too badly, you could require users to be logged into an account before they can access the API, put a CAPTCHA on account creation, and limit the number of API calls per account.

Improve this answer
0

I have recommended the following method in other circumstances, but if he has truly made himself a botnet (as opposed to spoofing his IP) it won't work.*

Basically, all you have to do is make a Java or Flash application that gets the IP of the user from the Java or Flash Player program installed on the computer. This should bypass proxies and spoofing (this is why TOR doesn't let you run script by default). You should then be able to make a blacklist of the IP(s) he REALLY is using.

*Based on the fact that "new [IPs are] popping as soon as [you] ban them" it would seem to me that he is almost certainly spoofing a few IPs that he owns rather than creating a botnet - this is also much less illegal.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .