Home / server / Questions / 1033598
In Process
A X
Asked: 2020-09-12 15:27:20 +0800 CST

Attacker using "single use IPs" to generate large volumes of robotic traffic that is hard to block

  • 772

Currently there is some wierd traffic on a HTTP server from lots of different IPs. I tried checking against known TOR exit nodes, but there were no matches.

They tend to be from countries in South America and Africa. However, none of the IPs are the same. So I'm not sure how the attacker is able to use so many different IPs, each IP only one time.

Does anyone know how an attacker might be able to get "single use IPs"? Perhaps they are from some sort of rented botnet? If so, is there an easy way I can check these IPs against a list of known threat IPs?

Any help would be greatly appreciated.

ip iptables ipsec

1 Answers

  1. If you don't need traffic or have clients from this country you should block the traffic based on the country if it is possible.

    • 1