Consumer app: probes that failed, and why
October 2026. Our consumer app's APIs on AWS were probed repeatedly by automated scanners. None got data. This page records what held, so we keep doing it.
What held
| What was tried | Why it failed | What we improved |
|---|---|---|
| Thousands of calls to internal service routes, learned from public API docs | Each internal route required an internal key, and answered 404 to everyone else | WAF rule blocking internal paths from outside, API docs turned off, key rotated |
| Staff sign-in on the public API host | Staff routes need a staff token audience; staff sign-in is strictly rate limited | Staff operations refused on the public host |
| Malformed ids and broken bodies sent to many queries | No data returned | Ids validated at the edge, so bad input is a 4xx, not a fake error spike |
| A burst of requests to the load balancer's raw address | WAF rules were host-scoped, but the default action for unknown hosts is 404 | Noted a rate rule without a host condition |
| The image optimiser asked to fetch internal addresses | The names did not resolve and the metadata address was refused | Image hosts allowlisted |
Endless .env, .git and CMS file probes | Nothing exists at those paths | WAF blocks them |
| One browser reconnecting to a WebSocket 65,000 times a day | Every attempt was rejected | Server-side throttle and a client fix |
Looks like an attack, but is not
Before you raise an incident, check these. Each one fooled us once.
- Many failed password sign-ins from in-app browsers were real users mistyping, not credential stuffing. Look at how many distinct accounts and IPs are involved.
- "Too many requests" on one-time code requests is the resend limit working.
- Code requests for emails with no account are people who forgot which email they used.
- Probes from the office IP were a teammate testing exposure.
- A burst of staff sign-in failures on staging was a teammate fighting their own TOTP.
Lessons
Rule
The WAF was in count mode for weeks and blocked nothing. Put managed rules in Block mode on launch day.
- Defence in depth worked: the WAF missed many probes, and the app still refused them.
- Public API docs are a map for attackers. Turn them off.
- Review logs weekly. Every improvement above came from a routine log scan.