#Username for trafficbot manual
#Username for trafficbot full
#Username for trafficbot android
#Username for trafficbot software
#Username for trafficbot code

But even if proxy is completely overloaded, if you placed it on separate host and used firewall to route traffic, as mentioned above, it still won't disturb other clients. And if attacker uses a real browser, even headless, or automates your real application client, then you hold even bigger advantage. With attack scripts generally written in dynamic languages that waste attacking device's resource faster than your optimized proxy compiled to binary, you can comfortably hold a big enough load. As long as your mini-handlers on proxy are doing nothing but sleeping, it will be hard to completely flood it - attackers most often do limit amount of sessions open from same IP and wait for answer - they don't have infinite resources too, after all. You don't have infinite resources, but neither does the attacker. Some proxies may even allow you to dynamically adjust delay depending on load. Let anything that doesn't match you problematic traffic pattern pass directly to real service and stall potentially problematic requests for some extra time like 5 seconds before letting them go to real logic. Network-based check like IP range can even be performed at firewall level, sending potentially problematic traffic to separate host assigned to this proxy, while letting the rest of traffic to avoid checks altogether. You don't need anything complex though - set up a small rules that can be checked with something fast and simple like pattern matching on request without accessing any external storage and route everything that 'path goes to login handler' + 'have IP from specific range' + '.any other peculiarity you noted.'.

If bot is still taking too much resources after that, then do the second thing: reduce your resource consumption even further and slow bot to a crawl through of a lightweight reverse proxy in front of your service - those are often extremely optimized to handle very high load while taking much less resources than 'real' service, thus lowering your chance to be DDoSed, but not fit to perform complex business logic. Extra speed is good for your service in any case. Maybe you won't need to do anything else if implementing those measures already makes load from the bot negligible. If you primary login/password DB is still slow after that, try introducing more lightweight caching through simpler key/value stores, preferably in-memory.

#Username for trafficbot code

Profile and improve sub-optimal code and database access. So before going for drastic measures do two other things to reduce impact:įirst: review your login handler. Unless you think that dealing with alienating those client is simpler.

#Username for trafficbot software

Even if you can narrow them down to IPs from specific location or some peculiarity in payload, blackholing them outright, as suggested in other answers is not a good option if you have any real clients from that location or whose software can realistically generate similar payload. 'access-control-allow-origin': 'file://',Īs you described, those attempts are pretty much indistinguishable from real logins of your clients. 'vary': 'X-HTTP-Method-Override, Origin', 'strict-transport-security': 'max-age=15552000 includeSubDomains',

#Username for trafficbot android

'user-agent': 'Mozilla/5.0 (Linux Android 5.1.1 SM-G973N Build/LYZ28N wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/XX.X.XXXX.XXX Mobile Safari/537.36', 'accept': 'application/json, text/plain, */*',

'content-type': 'application/x-www-form-urlencoded', Why would someone even bother doing this? Are there any additional things I could be doing to mitigate the risk? Should I be worried about this? My biggest concern is the DDOS element with regards to system load. 99% of the emails are not in my system anyway, so it seems to just be a bot with a list of emails and passwords trying to gain access. It seems like someone is fishing for email/ password matches. I can't think of a way to mitigate this attack.

#Username for trafficbot full

Below is a sample of the full details from one request.

#Username for trafficbot manual

Each request is coming from a different public IP address (all seem to be coming out of Phoenix, Arizona from my manual spot check)Īll of the requests are coming via an mobile app I built which loads the login webpage via a webview. Each request is using a different email (from spot checking) and each one has failed with a 401 and no information. Over the last half an hour or so, my website has been 20,000 failed login requests.

Failed login attempts return a non-specific error (i.e.

Minimum password requirements (8 chrs, letter, number, capitals).

Account lock for 30 min after 5 failed login attempts (using same email).

It seems complex enough and very well executed. For the second time my website seems to be the target of a large automated attack.