API Abuser

• Request rate far exceeding documented API rate limits from a single API key or IP
• Sequential iteration through resource IDs (e.g., GET /api/users/1, /api/users/2, …)
• High volume of 401/403 responses followed by successful authentication (credential stuffing pattern)
• Multiple API keys from different accounts making identical programmatic requests
• Distributed requests across many IPs arriving at uniform intervals (botnet-driven)
• Automated account registration at scale via /api/register or OAuth flows
• API key reuse across geographically impossible locations within short time windows
• Requests missing standard browser headers (X-Requested-With, Origin) that legitimate client SDKs send

Application-level rate limit logging

# Django REST Framework throttle logging example
import logging
from rest_framework.throttling import AnonRateThrottle

logger = logging.getLogger("api.throttle")

class LoggedAnonRateThrottle(AnonRateThrottle):
    def throttle_failure(self):
        logger.warning(
            "API rate limit exceeded",
            extra={"ip": self.request.META.get("REMOTE_ADDR"), "path": self.request.path},
        )
        return super().throttle_failure()

Nginx — detect and log excessive API calls

# Rate limiting zone for API endpoints
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=60r/m;

location /api/ {
    limit_req zone=api_limit burst=20 nodelay;
    limit_req_status 429;
    access_log /var/log/nginx/api_access.log combined;
}

fail2ban — ban API abusers

[nginx-api-abuse]
enabled  = true
filter   = nginx-api-abuse
logpath  = /var/log/nginx/api_access.log
maxretry = 100
findtime = 60
bantime  = 86400

Log analysis — detect credential stuffing

# Count 401 responses per IP in last hour
awk '$9 == 401 {print $1}' /var/log/nginx/api_access.log | \
  sort | uniq -c | sort -rn | awk '$1 > 20 {print $0}'

Snort rule

alert tcp any any -> $HTTP_SERVERS $HTTP_PORTS \
  (msg:"API Abuse — Sequential Resource Enumeration"; \
   flow:to_server,established; \
   content:"GET /api/"; \
   pcre:"/\/api\/[a-z]+\/\d+/i"; \
   threshold:type threshold, track by_src, count 100, seconds 60; \
   classtype:web-application-attack; sid:9100026; rev:1;)

1. Implement per-key and per-IP rate limiting at the API gateway layer (e.g., Kong, AWS API Gateway, Nginx) with documented limits enforced via HTTP 429 responses.
2. Require strong API key authentication and rotate keys automatically; avoid long-lived static keys.
3. Detect and block credential stuffing by monitoring the ratio of 401/403 responses per IP and implementing CAPTCHA challenges after repeated failures.
4. Deploy an API gateway with bot detection capabilities — flag requests missing expected SDK headers, unusual TLS fingerprints (JA3), or impossible geo-velocity.
5. Implement exponential backoff enforcement: progressively increase ban durations for repeated violators.
6. Use resource-level access controls: ensure API endpoints return only data the authenticated principal is authorized to view; avoid sequential integer IDs in public APIs (use UUIDs).
7. Monitor API key usage patterns — alert when a single key's request volume, geographic distribution, or endpoint diversity deviates significantly from its historical baseline.
8. Publish clear API Terms of Service and enforce them legally for commercial competitors harvesting your data.
9. Implement token binding or PKCE for OAuth flows to prevent authorization code interception and replay attacks.

In 2016, a credential stuffing attack against Spotify's API using 4 million leaked username/password pairs from unrelated breaches resulted in approximately 300,000 account takeovers — attackers automated login attempts at a rate of ~100 requests per second per IP using a rotating residential proxy network. In 2021, T-Mobile suffered a data breach in which an attacker used a misconfigured API to enumerate IMSI numbers and extract personal data for 54 million customers — the API lacked rate limiting and had no anomaly detection for sequential resource enumeration.