title: how to avoid short message send attack
body: <p>I have an api that allow user to send to phone 6 digital verify code. But now I am facing a problem that some attackers invoke this send api to attack. The send message api will pay some money to the cloud service. What I am tried to defend the attack like this:</p>
  <ul>
  <li>one phone number could send 5 message in a period of time, but the attacker could change the phone number.</li>
  <li>One IP could send 100 message in a period of time, but the attackers could change the IP address.</li>
  <li>The next time to send avaliable will take 1min, but they can send many request for one time</li>
  </ul>
  <p>what should I do to defend the SMS api attack?</p>