I blocked this entire network.
Code
NetRange:       47.74.0.0 - 47.87.255.255
CIDR:           47.76.0.0/14, 47.80.0.0/13, 47.74.0.0/15
NetName:        AL-3
NetHandle:      NET-47-74-0-0-1
Parent:         NET47 (NET-47-0-0-0-0)
NetType:        Direct Allocation
OriginAS:       
Organization:   Alibaba Cloud LLC (AL-3)
RegDate:        2016-03-17
Updated:        2017-04-26
Ref:            https://rdap.arin.net/registry/ip/47.74.0.0
Their IPs were responsible for a tripling of our traffic, and I'm sure I'll find all sorts of bogus queries in the logs.
Code
grep -c 47.76.99.127 /var/log/httpd/stovebolt/ssl_access_log
382974
Code
# grep -c 47.76.209.138 /var/log/httpd/stovebolt/ssl_access_log
382905
And, our performance has returned to normal.

Last edited by Baldeagle; 10/18/2024 5:58 PM.
The Stovebolt Geek
https://www.stovebolt.com/ubbthreads/ubbthreads.php

Server Information
UBB.threads Version 8.0.0
Release 20240826
Server OS Linux
Server Load 0.11
Web Server Apache/2.4.37
PHP Version 8.3.11
MYSQL Version 8.0.39
Database Size 1.82 GB