A week ago someone kept hammering my traffic — see Notice: This Site Was Recently Hit by Malicious Traffic. Today, past 4 a.m., every monitoring channel started howling at me through app, DingTalk, email, and SMS: another scan. Fortunately, having been burned last time, I already had countermeasures ready, so there was essentially no damage.
Visitor information
- IPv4: 34.75.62.181
- Location: Moncks Corner, South Carolina, United States
- Line: Google Cloud datacenter
Timeline
- 2022-05-10 04:38:24 First accessed my homepage via Python; started scanning five seconds later
- 2022-05-10 04:38:29 Started scanning every page on the site. The UA was randomly generated; requests covered nearly all pages, APIs, CSS, images, and other static files
- 2022-05-10 05:48:14 Requests turned invasive:
../../and similar began appearing in parameters, probing config file paths - 2022-05-10 07:07:35 WAF switched to strict mode; requests began slowing down
- 2022-05-10 07:37:05 Scanning stopped, or the attacker finished their scan plan
Summary
This scan probably has nothing to do with the previous one. It was far more professional: it scanned every page, rotated the UA dynamically, and tried probing parameters and APIs. I hope it was a one-off.
Among the requests I also saw attempts to reach /.svn/, which suggests a scanner blindly guessing paths. Thanks to last time’s lesson I’d put a WAF in place ahead of it, so it did me no harm — only, with strict inspection on, the whole site slows down and some APIs get blocked by mistake.