The last couple of days I've been having some weird small DDoS attacks on different VPS's I have online.
The first one I detected using netstat and I noticed a bunch of IPs that were from a different region (resulting in Singapore) so I used
ufw deny from x.y.0.0/16 to block the entire subnet as it was varying on the last 2 numbers. That worked.
Now today I am having the same issue on a completely different VPS just that this time besides the IP there are also some addresses that say for example
miami-1.octovpn.net (that's a real value in this case). I blocked the IP range in that case, but I am not sure how to block a wildcard domain from accessing the site using ufw.
I thought of something like:
ufw deny from *.octovpn.net
But the command returned
ERROR: Bad source address.