we just changed the DNS to Cloudflare. My site is mainly for users in Germany.
Since we changed the DNS to Cloudflare we have massive requests from the USA.
Usually we have 5 visitor per minute. Now we have 30 requests per seconds, so that our page would be done if I didn’t firewalled the requests from the USA.
Now five days have passed, but there are still massive requests, which I have to block. Does somebody have a similar problem after changing the DNS?
I can’t recall seeing that happen before. It’s weird to see so many from the 107 block.
How were you measuring hits to your site before?
ips seem to be from know spamming/scanner ASN for colocrossing https://myip.ms/view/web_hosting/11414/Colocrossing_Inc.html
some web site operators I know deliberately block the entire colocrossing ASN at firewall level just for peace of mind
so could be malicious scanners coincidentally scanning your at same time as DNS change ?
The following ASN make 99% of the traffic generated from the USA
AS64267 AS-SPRIOUS - Sprious LLC
AS36352 AS-COLOCROSSING - ColoCrossing
AS61317 ASDETUK http://www.heficed.com
AS55286 SERVER-MANIA - B2 Net Solutions Inc.
AS395954 LEASEWEB-USA-LAX-11 - Leaseweb USA, Inc.
AS15003 NOBIS-TECH - Nobis Technology Group, LLC
I think rather than blocking the whole United States I should only block these ASN.
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.