My website keeps being hit by iPhones...am I being DDOSed?

Question

66.65.71.240 - - [05/Aug/2011:21:56:09 -0700] "GET /api/account_verify?accesstoken=k198nrtc7flswo6qhimuv5pd0 HTTP/1.1" 500 2334 "-" "Geolo 1.0 rv:18 (iPhone; iPhone OS 4.3; en_US)" "at:-" "dt:-" secure
220.128.111.225 - - [05/Aug/2011:21:56:11 -0700] "GET /api/account_verify?accesstoken=dv8asg0lwh2m1iu95bo3y6cjt HTTP/1.1" 500 2334 "-" "Geolo 1.0 rv:18 (iPhone; iPhone OS 4.3.3; en_SG)" "at:-" "dt:-" secure
124.171.7.154 - - [05/Aug/2011:21:56:13 -0700] "GET /api/account_verify?accesstoken=apu4q0sxtejni76z58ykwdrgl HTTP/1.1" 500 2334 "-" "Geolo 1.0 rv:18 (iPhone; iPhone OS 4.3.4; en_AU)" "at:-" "dt:-" secure
216.220.110.238 - - [05/Aug/2011:21:56:13 -0700] "GET /api/account_verify?accesstoken=9m6aqr4h2x0sp7fblw1ycveo5 HTTP/1.1" 500 2334 "-" "Geolo 1.0 rv:18 (iPhone; iPhone OS 4.2.1; en_US)" "at:-" "dt:-" secure
166.205.10.149 - - [05/Aug/2011:21:56:14 -0700] "GET /api/account_verify?accesstoken=drxk7to1zpa2q6e0j854bvs9w HTTP/1.1" 500 2334 "-" "Geolo 1.0 rv:18 (iPhone; iPhone OS 4.3.4; en_US)" "at:-" "dt:-" secure
98.245.120.235 - - [05/Aug/2011:21:56:14 -0700] "GET /api/account_verify?accesstoken=glrt54z63sviwqmu7ap0nyxdb HTTP/1.1" 500 2334 "-" "Geolo 1.0 rv:18 (iPhone; iPhone OS 4.3.5; en_US)" "at:-" "dt:-" secure
87.194.95.202 - - [05/Aug/2011:21:56:14 -0700] "GET /api/account_verify?accesstoken=816vsbxt97c50enwifrug3mad HTTP/1.1" 500 2334 "-" "Geolo 1.0 rv:18 (iPhone; iPhone OS 4.3.5; en_GB)" "at:-" "dt:-" secure
189.99.37.102 - - [05/Aug/2011:21:56:15 -0700] "GET /api/account_verify?accesstoken=75ve4c0dbtpxijsa68q3nf9z1 HTTP/1.1" 500 2334 "-" "Geolo 1.0 rv:18 (iPhone; iPhone OS 4.3.2; en_US)" "at:-" "dt:-" secure
166.205.139.225 - - [05/Aug/2011:21:56:19 -0700] "GET /api/account_verify?accesstoken=eri6nktvz2bgwyfmdhajlp1xo HTTP/1.1" 500 2334 "-" "Geolo 1.0 rv:18 (iPhone; iPhone OS 4.3; en_US)" "at:-" "dt:-" secure
67.164.74.99 - - [05/Aug/2011:21:56:20 -0700] "GET /api/account_verify?accesstoken=qrjf1904bpmoiexst32vcauyh HTTP/1.1" 500 2334 "-" "Geolo 1.0 rv:18 (iPhone; iPhone OS 4.3.5; en_US)" "at:-" "dt:-" secure

I created a script that checked how many unique IPs there were. It turns out there is 48 unique IPs, hitting me 3 times a second.

The number of unique IP's increases slowly (now it's up to 53, and it's been 5 minutes).

This is not normal of course (I only have 10 people who downloaded my iPhone app, and there's no way the app was programmed to hit this endpoint constantly)

Some come from Netherlands, too

150 requests per second is the world's most ineffective DDoS. — womble, Aug 06 '11 at 05:49
I'm thinking of collecting @womble's one-liners to pop in my sig block:-) — Rory Alsop, Aug 09 '11 at 09:18

score 5 · Answer 1 · answered Aug 06 '11 at 08:01

There is nothing to worry about. 3 times a second is not even worth talking about. 3,000 times a second should make you aware. And >20,000 unique IP addresses make it a tiny DDoS.

Everything smaller is just a hint that something is either wrong with your iPhone App, the registration process of your iPhone App or the advertising of your iPhone app.

My website keeps being hit by iPhones...am I being DDOSed?

1 Answers1