CSF x Meta Abuse IPv6

Leo Santis

• March 09, 2026 20:11

I’ve been suffering with high load peaks recently and some investigation, I’ve noticed several process hanged on Apache by IPs like 2a03:2880::

Basically, I’m getting abused by Meta as this IP Subnet belongs to them and it’s been getting reported everywhere as well as figuring in many Blacklists. Hard to believe but it’s true.

So, as I have CSF, I’ve just Quick Denied all the IP subnet 2a03:2880::/32, checked a few IPs using:

csf -g 2a03:2880:27ff:76::

and getting back:

IPSET: Set:chain_6_DENY Match:2a03:2880:27ff:76:: Setting: File:/etc/csf/csf.deny

I believe in my case CSF config is OK for that, right?

Server load got a little better after that but checking  Server Status >>Apache Status I still still can hundreds of those 2a03:2880:xxx Ips on Apache connections consuming CPU and memory.

I’m running on Alma9 + Nginx Manager and I don’t know if this makes any difference and need extra configuration to get Meta away from me.

Any ideas?

• 

  mtindor

  • March 10, 2026 00:11

  If you happen to have some sites running behind Cloudflare and your using mod_remoteip, remember that IPV4/IPV6 addresses behind cloudflare for which you are seeing because you use mod_remoteip, you can't block with CSF.

  I don't know if that is your issue or not.  Just throwing it out there.

  Mike

  0
• 

  Leo Santis

  • March 10, 2026 11:54

  Hi mtindor

  I really use mod_remoteIP, although never been an issue when it was about IPv4. Only on this case when I had to block a whole IPv6 subnet.

  I’m not sure, may be mod_remoteIP is not properly dealing with IPv6 or something.

  I have included this subnet in a Cloudflare WAF Block rule and it seems to be effective. In a single hour, it has blocked more the 20k requests from this Meta subnet. 

  2
• 

  cPRex Jurassic Moderator

  • March 10, 2026 14:40

  I'm glad to hear that solution is working well!

  0

Please sign in to leave a comment.