title: How to stop hack/DOS attack on web API
body: <p>My website has been experiencing a denial of service/hack attack for the last week.  The attack is hitting our web API with randomly generated invalid API keys in a loop.</p>
  
  <p>I'm not sure if they are trying to guess a key (mathematically impossible as 64bit keys) or trying to DOS attack the server.  The attack is distributed, so I cannot ban all of the IP address, as it occurs from hundreds of clients.</p>
  
  <p>My guess is that it is an Android app by the IPs, so someone has some malware in an Android app, and use all the installs to attack my server.</p>
  
  <p>Server is Tomcat/Java, currently the web API just responds 400 to invalid keys, and caches IPs that have made several invalid key attempts, but still needs to do some processing for each bad request.</p>
  
  <p>Any suggestions how to stop the attack?  Is there any way to identify the Android app making the request from the HTTP header?</p>