27 Apr
2022
27 Apr
'22
9:26 p.m.
Yeah, we are seeing it too on FCIX, bad enough that we've backed the micro-mirrors out from serving CentOS because we didn't want those to get overrun (single 1gbe connection on those).
On 4/27/2022 11:55 AM, Paul Mezzanini wrote:
We've been noticing the exact same behaviour and are still discussing internally the best way to address it.
Don't know a good way to handle it other than do the blocking on the agent strings mentioned elsewhere. At least with our stats collection it all seems to be coming from only one or two ASNs, so it might be worth just publishing a "block all these IPs that originate at these ASNs" too as, effectively, known bad actors.
- John 'Warthog9' Hawley