Looking at your logs - when under a DDoS attack

One of our sites got under a DDoS attack this past week and we thought it would be interesting to share the logs on how a DDoS attack looks like. The attack was on layer 7 ( HTTPS ), where thousands of IPs were generating thousands of requests per second against this one site.

The site was behind the NOC waf/cdn and it automatically blocked the attack using their javascript challenge, keeping their network and the site up during the whole time, but the logs still show all what was going on.

Attack duration

The attack wasn't very long and it only lasted about 1 hour. We noticed from previous experiencies that when the attacker can't take down the site, they will give up after 30 min to 1 hour. Specially if they are using a booter service where they are paying per minute of DDoS. If it is not working, they likely don't want to keep paying for it.

Attack timeline:

24/Sep/2024 02:31:22 started
24/Sep/2024 03:36:18 ended

Attack size

When it started, the attack wasn't very big, with only a few hundred requests per second. For example, for the first few minutes, it went from 101 to 107, 137 and 192 requests per second:

#requests_per_second #time
101 24/Sep/2024 02:31:22
107 24/Sep/2024 02:31:23
137 24/Sep/2024 02:31:24
192 24/Sep/2024 02:31:25
146 24/Sep/2024 02:31:26
156 24/Sep/2024 02:31:27
158 24/Sep/2024 02:31:28
176 24/Sep/2024 02:31:29
170 24/Sep/2024 02:31:30
195 24/Sep/2024 02:31:31
230 24/Sep/2024 02:31:32


But it kept slowly growing to thousands per second later. In total, the average was only 7,077 requests per second, but during the peak of the attack it reached over 120,000 requests per second. And stayed at over 60,000 for a while:

It also had many cycles, where it would go up to almost 100,000 requests per second and back down to just a couple hundred for a while. That's enough power to get most sites and servers down - and likely get the server disabled by their hosting providers. As all popular hosting providers take down (null route) the site IP in case they detect a DDoS attack against it.

This graph gives an idea on how it looks like:

Attack sources and IPs

The attack happened over IPv4 from 1,924 different IP addresses pretty distributed across hosting providers and locations. Just in the top IPs used in the attack, we can see the most popular hosting / cloud providers:

AWS, Azura, GoDaddy, Network Solutions, Digital Ocean, OVH, Linode, Vultr.. They are all there. So the attackers were clearly using cloud servers (most likely powerful servers) instead of end user devices for the ddos. Looking at the ASNs, we got a total of 780 different networks, with the top ones being:

When we break down by countries, we can see requests from 97 countries (pretty well distributed) with the top ones being:

What else about the attacking IP addresses

We spent a bit more time looking at the attacking IP addresses and their reputation and we noticed that many of them had web servers running, some of them were running Plesk or cpanel or just the standard nginx on port 80.

Based on the reputation tests, we can see:

Proxy categorized: 25%

Running webserver: 34%

Previously tagged as a malicious IP: 7%

Server responding to pings: 81%

Checking them on DNSrepo, we can see thousands of domains hosted on those attacking IPs.

Based on our experience with hacked sites, I am assuming the majority of those are likely compromised. Some of them have open proxies installed, which can also lead to this problem.

How does the logs look like?

The logs by itself are very boring with nothing in special. The attackers were using random referers (like amazon, google, kijiji, etc) and random users agents (160 total) in an attempt to make it a bit harder to block the attack. The attack logs itself look like this:

But multiply by many million and from almost 2,000 IP addresses. Overall, it is always fun to parse logs to try to find patterns and see if there is anything novel on an attack. In this specific case, it was a basic HTTP flood attack, going against the root of the site.

If there is anything else you would like to see, let us know. All those IPs are tagged on the NOC reputation site now.



Posted in   ddos   logging     by trunc_team