@seb @thegibson @tek @ajroach42 @angristan @snder Kafuka.ME has also been subjected to the same attack. One I noticed that wasn't on your list was attacks from 184.108.40.206. I've been playing wack-a-mole all day with the pending requests. I've been adjusting firewalls and harding as I go, but if we have a known bad actors list or an automatic system that would make things a bit easier as things happen..
I started two lists that I will maintain - Happy to add anyone's IOCs to it. Also ran the IPs and domains through some threat intel tools - Seems to be anonymizing infrastructure mainly. Also, the sheer size of the infrastructure (incl. all the mx records of the domains etc.) makes me believe this actor is doing this professionally.
Servidor social en català per a la comunitat de llengua i cultura catalanes d'arreu d'internet.