A comprehensive overview of IP-based security threats — from DDoS to credential stuffing — and the defences that work.
IP addresses are the identifiers of the internet, and as such they're central to virtually every category of cyberattack. Attackers exploit IP-level weaknesses to bypass access controls, overwhelm infrastructure, hide their identity, and identify vulnerable targets. Understanding the threat landscape at the IP level is foundational to building effective defences.
A DDoS attack floods a target with traffic from many source IPs simultaneously, exhausting its bandwidth, processing capacity, or connection limits until legitimate users can't reach it. The distributed nature is what makes DDoS devastating — the traffic comes from thousands or millions of sources, making simple IP blocking ineffective.
DDoS attacks come in several flavours:
Defence: Effective DDoS mitigation requires upstream scrubbing (traffic analysis before it reaches your network), anycast routing to absorb attacks across multiple PoPs, rate limiting at the edge, and automatic traffic diversion during attacks. Services like Cloudflare, Akamai, and AWS Shield provide always-on DDoS mitigation at the infrastructure level.
IP spoofing involves forging the source IP address in outgoing packets to impersonate another host. This is used in reflection and amplification attacks — the attacker sends requests to amplifiers (DNS servers, NTP servers, memcached) with the victim's IP as the source. The amplifiers send their (large) responses to the victim, generating a flood of traffic the victim never requested.
Defence: BCP38 (Network Ingress Filtering) prevents ISPs and network operators from forwarding packets with spoofed source addresses out of their networks. RPKI (Resource Public Key Infrastructure) helps validate that BGP route announcements come from legitimate ASes. End-to-end, spoofing is primarily an infrastructure problem requiring ISP cooperation to solve.
Credential stuffing uses lists of leaked username/password pairs (from data breaches) to attempt automated logins across many services. The premise is that many users reuse passwords — a credential that worked on a breached forum might also work on your banking login. Attackers rotate through thousands of IP addresses (often from residential proxy networks) to avoid per-IP rate limits.
Defence: Multi-factor authentication (MFA) is the most effective protection — a credential from a breach is useless if a second factor is required. Per-IP rate limiting, device fingerprinting, and velocity checks on login failures also reduce attack effectiveness. Password breach checking at login (comparing entered passwords against known-breached hashes via services like HaveIBeenPwned) helps users identify compromised credentials.
Before attacking a target, adversaries scan for open ports to identify running services and then probe those services for vulnerabilities. Tools like Nmap, Masscan, and Shodan make large-scale scanning trivially easy. A single malicious actor can scan the entire IPv4 address space in under an hour with the right tools and bandwidth.
Defence: Run a minimal attack surface — close all ports you don't need, move services to non-standard ports (though this is security through obscurity, not real protection), and deploy network-level filtering that blocks traffic to ports with no corresponding service. Intrusion detection systems (IDS) can identify scanning patterns and alert or block the source.
Botnets are networks of compromised devices (home routers, cameras, servers, IoT devices) controlled by an attacker through a command-and-control (C2) infrastructure. Botnets are used for DDoS, spam campaigns, credential stuffing, ad fraud, and cryptocurrency mining. The IP addresses involved are real devices — residential IPs, business connections — making them harder to block than datacenter IPs.
Defence: Botnet IP ranges are tracked by threat intelligence services using honeypots and traffic analysis. Blocking known C2 IPs at the DNS and network level prevents compromised devices in your network from receiving commands. For incoming traffic, treating residential IPs with very high request rates or unusual patterns as potential bot traffic helps catch compromised devices being used for attacks.
BGP hijacking occurs when a malicious (or misconfigured) AS announces routes for IP prefixes it doesn't legitimately control. If other networks accept the hijacked announcement, traffic destined for the victim's IP range is redirected to the attacker's infrastructure, enabling interception, traffic analysis, or blackholing (making services unreachable).
Defence: RPKI (Resource Public Key Infrastructure) allows IP address holders to cryptographically sign which ASes are authorised to announce their prefixes. Networks that filter BGP announcements against RPKI validation (Route Origin Validation, or ROV) reject hijacked routes. Adoption has been growing but remains incomplete.
No single control defeats all IP-based threats. Effective defence layers multiple controls:
The goal isn't to build an impenetrable barrier — it's to raise the cost of attacks until they become economically unviable for the attacker.
Need proxy detection, VPN detection, or abuse scoring in your own application?