Do domains frequently change their IP addresses

Question

I have the domain of some organization that requests my site too much. I want to restrict their access - but how? We only have the domain of the requester sfasu.edu . The QA of our team is using tool like https://www.whatismyip.com/dns-lookup/ to detect the IP of that domain, then having the IP we add some throttling rule to restrict it. But Im not sure if the IP I obtain is static and wont change tomorrow.

I guess my question is: Is this approach reliable to filter/throttle requests having their domain like sfasu.edu .

Moreover - what if there are 1 000 000 users using that same domain/IP address but only one of them is abusing my site (by issuing too many requests). It could be thousands of clients behind NAT.

To me this approach is suspicious.

Answer 1

It is a university and they own a /16 network and a /24: https://bgp.he.net/AS3634

They also have their own AS (AS3634) so in layman terms they are the own ISP.

You could even block/restrict the whole range by CIDR although I prefer the surgical approach. The most reasonable is to restrict the offending IP address first, and see if the abuse persists.

If you have a domain name you should have IP addresses. Check your logs.

You could also get in touch with the IT department but there must be lots of users in that organization and it may be difficult to police the activities of individual users. But if the abuse is serious enough you should try.

Having some form of rate limiting in place is reasonable, regardless of the source.

In your case, a WAF (web application firewall) should be an option to apply selective throttling based on some patterns (eg URLs) and source IP address.

Answer 2

That depends on their ISP data plan.

Many businesses use static IP addresses that never change, but many others haven't fixed that with their ISP and their IP address may change on a daily basis, on router reboot, or some other occasion.

Your guess is a guess. You should clarify this question with the respective organization.

As to security: of course, any user authorized for that IP address can potentially abuse your service. Real security requires dedicated authentication for each user.

If your services are regularly abused by that public IP address you should try to contact the owner (from WHOIS) and request a solution. If they don't cooperate you'll have to generally throttle/restrict access from that IP address to your service - most firewalls provide QoS features that allow limiting the number of sessions, bandwidth or connection frequency.

If a service is frequently abused by changing IP addresses, you need to create an automatic service that tracks abuse and temporarily blocks the source address.