Skip to content

Comment on Analyzing the attacks on my website

Comments

Another useful classification is to get the ASN and CIDR block the attacks are coming from, allowing broader blocks or rate-limiting from high-noise / high-attack network space.

The Routeviews project (https://www.routeviews.org/) provides a reverse-lookup which returns ASN and CIDR for a given IP. For example:

    $ host -t txt 240.230.216.209.asn.routeviews.org
    240.230.216.209.asn.routeviews.org descriptive text "21581" "209.216.230.0" "24"
That's the ASN (AS21581 -- M5HOSTING / M5 Computer Security) and CIDR block (209.216.230.0/24) for news.ycombinator.com, a/k/a 209.216.230.240.

What I've frequently found is that hostile traffic is fairly highly concentrated among bad-actor space, often datacentres with little reason to be generating end-user traffic or HTTP requests. Though that includes a surprisingly large quantity of web crawlers (few of which belong to any organisations you've heard of).

And for those individuals (or organisations) making heavy use of the resource, the zonefiles are downloadable, for local query capabilities / reduced latency.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.