Challenges with IP spoofing in cloud environments

This report analyzes the technique of IP spoofing in cloud architectures that rely on reverse proxies, highlighting how attackers can forge X-Forwarded-For and similar headers to bypass controls like rate limiting and anomaly detection. Using large-scale telemetry, it shows significant exposure and signs of probing (e.g., widespread presence of XFF, low/variable XFF patterns), and recommends mitigations such as sanitizing or dropping XFF at the edge, trusting single-IP vendor headers, configuring trust depth in application frameworks, or injecting controlled headers via gateways (e.g., NGINX, Lambda@Edge). It underscores the lack of a universal standard across providers and the operational need to explicitly define which headers to trust.