Attackers discover APIs in 29 seconds and steal 10m user entities in a minute

Wallarm, the recognized leader in API security, built a globally distributed API honeypot spanning 14 locations. It baits attackers with simulated API environments, from REST and XML-RPC to GraphQL, and records every exploit attempt in detail. Attackers now go after APIs first. They find newly deployed endpoints in 29 seconds on average, with the slowest at 34, and getting from an open port to a valid API call often takes under a minute. Exploitation starts almost immediately after that.

Wallarm saw attackers using about 50 IP addresses, each sending 50 requests per second, for a total of 2,500 RPS. That is cheap. Each IP costs $50–$150 a month, and the traffic uses only around 20 Mbps of bandwidth. By batching API calls through protocols like XML-RPC or GraphQL, attackers can pull 10 million user records in as little as 6 seconds; a single-request approach takes around 66 seconds for the same haul, and old-style web scraping could take 1,666 seconds.

Watching ports 80 and 443 alone isn’t enough. Attackers scan many other ports for anything exposed or misconfigured, and they target popular API products and known CVEs, turning small security gaps into full breaches.

APIs have overtaken regular web applications as top targets because they give fast, high-volume access to user data. Defenses have to react just as fast. Traditional monitoring often misses these bursts, especially when bandwidth stays around 20 Mbps, far below typical DDoS volumes.

Wallarm’s honeypot research makes the case for real-time API visibility and governance. Track every endpoint. Patch or segment risky services, and block suspicious traffic immediately, because even popular, brand-name API products can’t rely on default settings when attackers go after them first.

The global dataset points to one conclusion: APIs drive business growth, and attackers follow the growth. One exposed API can leak millions of records in seconds. Companies need layered protections that scale as fast as the attacks do. Wallarm’s research shows the question is when attackers will come for your APIs, and today “when” is measured in seconds.

Download full report: https://hubspot.wallarm.com/hubfs/API%20Honeypot%20report.pdf

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.