Hi all,
looking at the web logs I found several PROPFIND requests, mostly to webmail.
The webmail server replies 301, but the client doesn't follow up; it repeats
the same request after some minutes. The total number of queries is too low to
be classified as DDoS.
Other web sites I host reply 405 (Method not allowed) or 403 (Forbidden), but I
only found 1 such request (from 79.133.126.183). Another site which replies
301 hosts a Mediawiki pages. Perhaps replies had been learned in the past.
I paste below the total count of requests per day and the partial count of
those directed to webmail, sometimes equal sometimes slightly below.
I also paste the source IPs, along with the total count of requests in the
period since last December 18th, the last time the IP was reported to AbuseIPDB
and the ISP. It shows they're likely 0wned devices. Still, cannot guess what
they're after.
Ideas?
Best
Ale
--
Daily counts
all webmail date
45 45 2025-12-18
109 109 2025-12-19
203 179 2025-12-20
177 163 2025-12-21
227 191 2025-12-22
189 167 2025-12-23
127 125 2025-12-24
132 132 2025-12-25
130 130 2025-12-26
124 124 2025-12-27
80 80 2025-12-28
76 76 2025-12-29
62 62 2025-12-30
66 66 2025-12-31
58 58 2026-01-01
77 72 2026-01-02
85 85 2026-01-03
70 70 2026-01-04
96 88 2026-01-05
81 78 2026-01-06
66 66 2026-01-07
61 60 2026-01-08
92 91 2026-01-09
69 69 2026-01-10
88 86 2026-01-11
43 41 2026-01-12
80 80 2026-01-13
24 22 2026-01-14
6 4 2026-01-15
7 5 2026-01-16
22 13 today, and counting
count IP last report ISP
2377 204.76.203.8; 2026-01-16 Intelligence Hosting LLC, NL
15 94.26.106.113; 2026-01-16 Telco power Ltd, DE
14 167.71.195.58; 2026-01-15 DigitalOcean, LLC, SG
14 157.230.254.13; 2026-01-15 DigitalOcean, LLC, SG
13 159.223.71.35; 2026-01-15 DigitalOcean, LLC, SG
12 174.138.22.55; 2026-01-15 DigitalOcean, LLC, SG
12 157.245.199.254; 2026-01-15 DigitalOcean, LLC, SG
11 157.230.44.100; 2026-01-15 DigitalOcean, LLC, SG
10 68.183.237.44; 2026-01-15 DigitalOcean, LLC, SG
10 188.166.237.187; 2026-01-15 DigitalOcean, LLC, SG
10 167.71.223.55; 2026-01-15 DigitalOcean, LLC, SG
10 104.248.147.10; 2026-01-15 DigitalOcean, LLC, SG
9 64.23.158.207; 2026-01-15 DigitalOcean, LLC, US
9 206.189.34.225; 2026-01-15 DigitalOcean, LLC, SG
9 178.128.57.139; 2026-01-15 DigitalOcean, LLC, SG
9 167.71.204.99; 2026-01-15 DigitalOcean, LLC, SG
9 159.223.43.210; 2026-01-15 DigitalOcean, LLC, SG
8 68.183.234.44; 2026-01-15 DigitalOcean, LLC, SG
8 188.166.219.249; 2026-01-10 DigitalOcean, LLC, SG
8 159.223.94.58; 2026-01-15 DigitalOcean, LLC, SG
8 157.230.251.161; 2026-01-15 DigitalOcean, LLC, SG
8 157.230.248.130; 2026-01-15 DigitalOcean, LLC, SG
7 167.71.222.93; 2026-01-15 DigitalOcean, LLC, SG
7 167.172.90.93; 2026-01-15 DigitalOcean, LLC, SG
7 165.22.101.34; 2026-01-15 DigitalOcean, LLC, SG
6 202.1.31.161; 2026-01-16 VIVSTAR TELECOM (OPC) PRIVATE LIMITED, SG
6 178.128.90.96; 2026-01-15 DigitalOcean, LLC, SG
6 139.59.123.216; 2026-01-15 DigitalOcean, LLC, SG
5 143.198.218.102; 2026-01-15 DigitalOcean, LLC, SG
5 139.59.118.74; 2026-01-15 DigitalOcean, LLC, SG
5 103.59.160.237; 2025-12-31 PT Gunung Sedayu Sentosa, ID
4 206.189.90.119; 2026-01-15 DigitalOcean, LLC, SG
4 159.65.7.27; 2026-01-15 DigitalOcean, LLC, SG
4 159.65.132.79; 2026-01-15 DigitalOcean, LLC, SG
4 159.223.52.119; 2025-12-31 DigitalOcean, LLC, SG
4 152.42.217.93; 2026-01-15 DigitalOcean, LLC, SG
4 143.198.194.12; 2025-12-29 DigitalOcean, LLC, SG
3 209.97.175.206; 2026-01-15 DigitalOcean, LLC, SG
3 206.189.90.228; 2026-01-15 DigitalOcean, LLC, SG
3 202.1.31.177; 2026-01-16 VIVSTAR TELECOM (OPC) PRIVATE LIMITED, SG
3 202.1.31.174; 2026-01-13 VIVSTAR TELECOM (OPC) PRIVATE LIMITED, SG
3 178.128.112.248; 2026-01-15 DigitalOcean, LLC, SG
3 174.138.26.23; 2026-01-04 DigitalOcean, LLC, SG
3 165.232.188.22; 2026-01-10 DigitalOcean, LLC, IN
3 157.230.143.80; 2026-01-16 DigitalOcean, LLC, US
3 152.42.245.162; 2026-01-14 DigitalOcean, LLC, SG
3 152.42.181.191; 2026-01-16 DigitalOcean, LLC, SG
3 146.190.100.245; 2025-12-20 DigitalOcean, LLC, SG
3 143.198.85.239; 2026-01-13 DigitalOcean, LLC, SG
3 143.198.217.200; 2025-12-29 DigitalOcean, LLC, SG
2 68.183.85.38; 2026-01-15 DigitalOcean, LLC, IN
2 209.145.56.211; 2026-01-15 Contabo Inc., US
2 188.166.228.51; 2026-01-15 DigitalOcean, LLC, SG
2 167.71.205.35; 2025-12-22 DigitalOcean, LLC, SG
2 165.232.191.158; 2026-01-15 DigitalOcean, LLC, IN
2 165.22.49.23; 2026-01-15 DigitalOcean, LLC, SG
2 165.22.242.127; 2026-01-15 DigitalOcean, LLC, SG
2 165.22.100.217; 2026-01-15 DigitalOcean, LLC, SG
2 159.89.201.109; 2025-12-22 DigitalOcean, LLC, SG
2 159.65.143.148; 2026-01-15 DigitalOcean, LLC, SG
2 159.223.94.187; 2025-12-29 DigitalOcean, LLC, SG
2 159.223.68.90; 2026-01-15 DigitalOcean, LLC, SG
2 159.223.47.230; 2025-12-22 DigitalOcean, LLC, SG
2 157.245.151.230; 2026-01-10 DigitalOcean, LLC, SG
2 157.245.111.226; 2026-01-10 DigitalOcean, LLC, IN
2 152.42.223.87; 2026-01-16 DigitalOcean, LLC, SG
2 143.198.196.161; 2026-01-15 DigitalOcean, LLC, SG
2 143.110.188.214; 2026-01-15 DigitalOcean, LLC, IN
2 129.212.229.125; 2026-01-16 DigitalOcean, LLC, SG
1 94.156.152.7; 2026-01-16 Internet Magnate (Pty) Ltd, BG
1 89.42.231.239; 2026-01-16 Amarutu Technology Ltd, NL
1 89.42.231.179; 2026-01-16 Amarutu Technology Ltd, NL
1 79.133.126.183; 2026-01-16 G-Core Labs Customer assignment, NL
1 68.183.75.104; 2026-01-16 DigitalOcean, LLC, DE
1 68.183.229.69; 2026-01-10 DigitalOcean, LLC, SG
1 64.225.26.162; 2026-01-16 DigitalOcean, LLC, US
1 46.101.187.13; 2026-01-16 DigitalOcean, LLC, DE
1 206.189.80.57; 2025-12-24 DigitalOcean, LLC, SG
1 202.1.31.176; 2026-01-12 VIVSTAR TELECOM (OPC) PRIVATE LIMITED, SG
1 159.89.204.13; 2026-01-16 DigitalOcean, LLC, SG
1 159.203.103.160; 2026-01-16 DigitalOcean, LLC, US
1 157.245.108.111; 2026-01-10 DigitalOcean, LLC, IN
1 152.42.251.97; 2026-01-15 DigitalOcean, LLC, SG
1 152.42.225.183; 2026-01-15 DigitalOcean, LLC, SG
1 152.42.217.192; 2025-12-29 DigitalOcean, LLC, SG
1 152.42.160.18; 2026-01-16 DigitalOcean, LLC, SG
1 142.93.219.218; 2026-01-15 DigitalOcean, LLC, IN
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
