Possible Botnet - How to Block Them

My Servers Block These IPv4 Addresses.

These made suspicious solr queries, sometimes leading to server crashes. It appears to be a botnet, purposefully overwhelming the network. It is possible some are not bad actors. But for now, these are blocked, and my servers are running better. I am also blocking IPv6 addresses, but that is more complicated, so for starters, here is my list of IPv4 addresses.

If you run a Linux machine, you could add these Uncomplicated FireWall (ufw) rules, by simply copying and pasting the entire code block below and pressing ENTER.

ufw insert 1 deny from 107.179.134.218
ufw insert 1 deny from 109.190.142.161
ufw insert 1 deny from 115.131.132.13
ufw insert 1 deny from 119.2.42.210
ufw insert 1 deny from 121.182.52.66
ufw insert 1 deny from 129.222.107.239
ufw insert 1 deny from 129.222.141.0
ufw insert 1 deny from 129.222.141.105
ufw insert 1 deny from 129.222.141.255
ufw insert 1 deny from 129.222.141.38
ufw insert 1 deny from 135.125.101.229
ufw insert 1 deny from 135.148.171.139
ufw insert 1 deny from 13.53.229.55
ufw insert 1 deny from 138.201.248.158
ufw insert 1 deny from 142.132.194.37
ufw insert 1 deny from 143.178.223.236
ufw insert 1 deny from 146.70.72.166
ufw insert 1 deny from 147.135.4.49
ufw insert 1 deny from 147.46.112.157
ufw insert 1 deny from 152.53.145.234
ufw insert 1 deny from 156.146.34.241
ufw insert 1 deny from 162.55.1.114
ufw insert 1 deny from 165.0.148.155
ufw insert 1 deny from 172.249.75.103
ufw insert 1 deny from 178.159.219.118
ufw insert 1 deny from 178.24.71.206
ufw insert 1 deny from 179.5.95.139
ufw insert 1 deny from 187.105.148.194
ufw insert 1 deny from 191.95.131.230
ufw insert 1 deny from 200.71.18.69
ufw insert 1 deny from 200.71.18.70
ufw insert 1 deny from 202.171.184.93
ufw insert 1 deny from 210.1.202.10
ufw insert 1 deny from 220.158.199.148
ufw insert 1 deny from 223.185.36.157
ufw insert 1 deny from 34.162.230.222
ufw insert 1 deny from 45.132.255.221
ufw insert 1 deny from 45.144.176.200
ufw insert 1 deny from 50.38.52.111
ufw insert 1 deny from 50.43.48.154
ufw insert 1 deny from 51.77.217.0
ufw insert 1 deny from 51.83.100.105
ufw insert 1 deny from 5.81.133.10
ufw insert 1 deny from 5.8.207.4
ufw insert 1 deny from 58.96.112.6
ufw insert 1 deny from 62.85.6.77
ufw insert 1 deny from 64.32.65.247
ufw insert 1 deny from 68.33.239.243
ufw insert 1 deny from 69.11.192.69
ufw insert 1 deny from 69.200.57.154
ufw insert 1 deny from 72.183.136.97
ufw insert 1 deny from 74.130.11.36
ufw insert 1 deny from 77.163.120.203
ufw insert 1 deny from 79.119.229.123
ufw insert 1 deny from 79.198.65.10
ufw insert 1 deny from 79.248.134.94
ufw insert 1 deny from 80.13.148.176
ufw insert 1 deny from 82.64.19.12
ufw insert 1 deny from 84.132.96.15
ufw insert 1 deny from 85.153.236.76
ufw insert 1 deny from 85.153.239.203
ufw insert 1 deny from 87.158.143.79
ufw insert 1 deny from 88.186.76.93
ufw insert 1 deny from 89.12.103.148
ufw insert 1 deny from 90.91.20.96
ufw insert 1 deny from 92.153.244.130
ufw insert 1 deny from 93.214.172.146
ufw insert 1 deny from 94.175.115.204
ufw insert 1 deny from 99.82.228.203

These rules can be deleted later, if you do not want to keep them, or if we learn that some are harmless.


Edit: Even Yacy peers appear to be sending out solr queries, with no admin settings available to stop it.

Admin settings that did not stop these solr queries from coming into the peers…