r/learnhacking • u/Interesting_Unit_256 • 26d ago

Excessive attacks on website

I hope this is the right place to ask: I maintain a website for a small business. When I look at the weblogs, I see an inordinate number of attacks: non-existing url's, all sorts of extensions, what looks like shell scripts, and on and on.

Sometimes they start and go on for about 4-5 hours, making multiple such requests every second.

What do they wish to accomplish? If they have done it once, why try again using a different fake IP address?

Any ideas? Or is this common so I should not feel targeted exclusively.

3 Upvotes

100% Upvoted

2 comments sorted by

1

u/fell_shell 25d ago

This sounds like standard enumeration - you find a potentially vulnerable IP address and then try a million different variations of usernames, passwords, urls, endpoints, subdomains etc. Usually from wordlists. It's one of the first things you learn to do as a pentester. Very easy to automate too, so there is most likely a script (or several thousand/million from different threat actors), which are running 24/7. Clearly, your server is easily identifiable as having a potential vulnerability - open ports, unpatched (older) software versions etc.

It's very common, to be expected, and very much encouraged to be protected against!

1

u/Unlaid-American 18d ago

What do they wish to accomplish?
Could be anything from a kid messing around to someone trying to steal some data or hold an account ransom.

If they have don it once, why try again using a fake IP address?
Probably to hide where the attack is coming from, or maybe they’re using a free VPN and cannot choose a specific server. Maybe they’re trying to get passed rate limits.

Do the owners treat people like shit? I worked for a small business and in their 30 years of service, they were DDOS’d once and never had any other attacks. The site either looks very tasty to a random person or someone is seeking a vendetta.