I got 47 Abuse-Emails while being DDOSed today. Thats in my normal range. Normally when there is a bigger bot net scanning port 22 etc I will get over 1000+ abuse mails a day. Could be they are scanning ranges that doesn't produce abuse mails or they do something otherwise fishy. No clue right now. With over 1 million extra sockets alone on my servers I am sure he/she/it has some beefy hardware.
nifty
On 25. Aug 2020, at 21:52, Toralf Förster toralf.foerster@gmx.de wrote:
On 8/25/20 9:20 PM, Roger Dingledine wrote:
Also, if more people than just Nifty and John are seeing them.
I got an abuse record from Hetzner for my relay (no Exit flag, but 2 dozen ports opened) at 8/18/20, 4:31 PM +0200 with a content like:
irection OUT Internal 5.9.158.75 Threshold Packets <snip> packets/s Sum 108.286.000 packets/300s (360.953 packets/s), 53.442 flows/300s (178 flows/s), 4,120 GByte/300s (112 MBit/s) ...
I had to temporary completly switch off "ExitRelay 1" to "ExitRelay 0" to avoid a server block by the hoster.
At the next day I re-opened one half of the exit ports (only DNS Jabber and IRC, no BitCoin et al) and did not experience any further abuse reports since then.
-- Toralf _______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays