rca

gistfile1.txt

Chris  [10:50 PM]
@Nafiis could you share what expected IPs your requests should be coming from?

We saw this for May 1-5 seedance-2 requests:
  ┌────────────────┬──────────┬─────────────────────────────────────────────────────┬───────────────────────────────────────────────┬───────────────┐
  │ Source IP      │ Requests │ Reverse DNS / PTR                                   │ ASN / Provider                                │ Geo           │
  ├────────────────┼──────────┼─────────────────────────────────────────────────────┼───────────────────────────────────────────────┼───────────────┤
  │ 3.122.123.44   │    4,337 │ ec2-3-122-123-44.eu-central-1.compute.amazonaws.com │ AS16509 Amazon                                │ Frankfurt, DE │
  │ 3.109.108.7    │       46 │ ec2-3-109-108-7.ap-south-1.compute.amazonaws.com    │ AS16509 Amazon                                │ Mumbai, IN    │
  │ 13.233.103.54  │       22 │ ec2-13-233-103-54.ap-south-1.compute.amazonaws.com  │ AS16509 Amazon                                │ Mumbai, IN    │
  │ 43.245.120.229 │        1 │ no PTR found                                        │ AS45245 Banglalink Digital Communications Ltd │ Dhaka, BD     │
  └────────────────┴──────────┴─────────────────────────────────────────────────────┴───────────────────────────────────────────────┴───────────────┘
here is the raw data of requests per day with API key ID and source IP
date,api_key,source_ip,number_of_requests
2026-05-01,219e1a75-3801-4789-9534-71949ec90174,3.109.108.7,13
2026-05-01,b3013560-8759-4a14-94ef-cd20ed258e85,3.122.123.44,273
2026-05-02,219e1a75-3801-4789-9534-71949ec90174,3.109.108.7,14
2026-05-02,b3013560-8759-4a14-94ef-cd20ed258e85,3.122.123.44,517
2026-05-03,219e1a75-3801-4789-9534-71949ec90174,3.109.108.7,6
2026-05-03,b3013560-8759-4a14-94ef-cd20ed258e85,3.122.123.44,1044
2026-05-04,219e1a75-3801-4789-9534-71949ec90174,3.109.108.7,10
2026-05-04,b3013560-8759-4a14-94ef-cd20ed258e85,3.122.123.44,398
2026-05-05,219e1a75-3801-4789-9534-71949ec90174,3.109.108.7,3
2026-05-05,2424b9c5-5646-4ce4-85aa-d766388f6f87,3.122.123.44,12
2026-05-05,9c9bf5a8-7941-45c6-8715-c4638d6d15b3,3.122.123.44,71
2026-05-05,aa1dca29-5756-497c-9c06-58ad7496335e,3.122.123.44,45
2026-05-05,b3013560-8759-4a14-94ef-cd20ed258e85,3.122.123.44,1050
2026-05-05,cbde4d9f-9064-43cd-9b41-e2db961eb97d,3.122.123.44,7
2026-05-06,2424b9c5-5646-4ce4-85aa-d766388f6f87,3.122.123.44,30
2026-05-07,2424b9c5-5646-4ce4-85aa-d766388f6f87,3.122.123.44,377
2026-05-08,2424b9c5-5646-4ce4-85aa-d766388f6f87,3.122.123.44,22
2026-05-08,790f31a1-231c-4697-8ef3-1a3c65ad6d7d,13.233.103.54,14
2026-05-09,2424b9c5-5646-4ce4-85aa-d766388f6f87,3.122.123.44,99
2026-05-10,2424b9c5-5646-4ce4-85aa-d766388f6f87,3.122.123.44,146
2026-05-11,2424b9c5-5646-4ce4-85aa-d766388f6f87,3.122.123.44,58
2026-05-12,2424b9c5-5646-4ce4-85aa-d766388f6f87,3.122.123.44,81
2026-05-12,790f31a1-231c-4697-8ef3-1a3c65ad6d7d,13.233.103.54,8
2026-05-13,2424b9c5-5646-4ce4-85aa-d766388f6f87,3.122.123.44,38
2026-05-14,122c05d7-59d4-4174-8377-d0584973b8b9,43.245.120.229,1
2026-05-14,2424b9c5-5646-4ce4-85aa-d766388f6f87,3.122.123.44,25
2026-05-15,2424b9c5-5646-4ce4-85aa-d766388f6f87,3.122.123.44,44
His answer was very vague. Which of the requests in the table I provided do they say are fraudulent? Which IPs are not theirs?
To agree to take any blame, I need very concrete evidence from him about which requests he things are not their so we can investigate"

If any of the IP's in the table don't belong to you please share to Chris so they can further investigate