a few minutes ago there was a massive attack on your server. We therefore route the affected IP address 37.X.X.X via our free DDoS filter. This filters all packets that cause the DDoS. So the services of your server that are not attacked remain accessible. Due to filtering, packet runtimes may be somewhat longer.

We check at regular intervals whether the attacks have subsided. Once this has happened, we will route the IP address 37.X.X.X directly back to your server.

Below you will find log extracts representing the attack patterns:

Start: 2023-08-16T01:47:36+00:00
Destination: 37.X.X.X
Direction: Incoming
Bandwidth: 69.7423248291 Mbit/s
Packets per second: 110305 pps

The following attack types were recognized:
This alert was generated due to fast flood detection. The “DNS” host alert signature has been triggered at router “ffrr.ssd.ube.dd”. (expected rate: 10.00 Kpps, observed rate: 30.00 Kpps)

The following pattern were detected:
Protocol: UDP
Destination Port: 53
Source Networks: 0.0.0.0/0
Source Port: 1024-65535
Traffic Data: 12952098 pps

Protocol: UDP
Destination Port: 53
Source Networks: 172.68.0.0/14
Source Port: 1024-65535
Traffic Data: 1319185 pps

Protocol: UDP
Destination Port: 53
Source Networks: 141.8.128.0/18
Source Port: 1024-65535
Traffic Data: 1310583 pps

Protocol: UDP
Destination Port: 53
Source Networks: 0.0.0.0/0
Source Port: 1024-65535
Traffic Data: 37085593 pps

Protocol: UDP
Destination Port: 53
Source Networks: 172.192.0.0/10
Source Port: 1024-65535
Traffic Data: 10467328 pps

Following Combinations are now ratelimited:
SRC: 0.0.0.0/0 SRCPORT: 1024-65535 DSTPORT: 53 PROTO: UDP
SRC: 172.68.0.0/14 SRCPORT: 1024-65535 DSTPORT: 53 PROTO: UDP
SRC: 141.8.128.0/18 SRCPORT: 1024-65535 DSTPORT: 53 PROTO: UDP
SRC: 0.0.0.0/0 SRCPORT: 1024-65535 DSTPORT: 53 PROTO: UDP
SRC: 172.192.0.0/10 SRCPORT: 1024-65535 DSTPORT: 53 PROTO: UDP