Amazon EC2 Instances on Torrents

[UserHEVC]

Does anyone know anything about all those Amazon EC2 Instances on TPB torrents? They are wasting an incredible amount of bandwidth and seeding nothing. 

I had to block 4 subnets (1.5 million IP Addresses) so far, to get them out of my seeding scope. They look like copyright troll bots to me, but I wanted to verify that.

[maskaw]

You mean this? https://thepiratebay.org/search.php?q=Am...=0&orderby=

There's only 2 torrents returned for search "Amazon EC2" both uploaded by trusted users..

[UserHEVC]

You mean this? https://thepiratebay.org/search.php?q=Am...=0&orderby=

There's only 2 torrents returned for search "Amazon EC2" both uploaded by trusted users..

No, I mean cloud servers physically joining my torrents. And wasting 30-50MB/s of bandwidth at a time. There is sometimes as much 5 of them per torrent, all from the same data center.

---

Just in-case anyone is interested, these are the 4 subnets I dropped to Amazon Cloud Services out of Ireland. There is no legitimate traffic coming from these subnets.

Code:

# Drop some ip ranges for Amazon EC2 instances
iptables -A INPUT -s 34.248.0.0/13 -j DROP
iptables -A INPUT -s 34.240.0.0/13 -j DROP
iptables -A INPUT -s 3.248.0.0/13 -j DROP
iptables -A INPUT -s 18.201.0.0/16 -j DROP

This will free up a lot of bandwidth. There is no overhead here to block 1.5 million IP Addresses. Only 4 rules are applied to incoming packets that are easy to determine.

[UserHEVC]

I'm going to keep on updating this list for other torrent seeders. I got 2.2 million IP Addresses and counting blocked now to Amazon Cloud Services that are being abused.

Code:

iptables -A INPUT -s 34.248.0.0/13 -j DROP
iptables -A INPUT -s 34.240.0.0/13 -j DROP
iptables -A INPUT -s 3.248.0.0/13 -j DROP
iptables -A INPUT -s 18.201.0.0/16 -j DROP
iptables -A INPUT -s 100.24.0.0/13 -j DROP
iptables -A INPUT -s 54.74.0.0/15 -j DROP

I got more seeders than my upload ratio on torrents now in the first 6 hours. My upload traffic is going to legitimate users that want to seed the torrents.

[maskaw]

It could be someone's DoS-ing you.

A few years ago while checking the logs on my VPS I noticed some bots were actively trying to bruteforce my SSH credentials. I had to change the port and restrict inbound packets to certain IPs.

[UserHEVC]

I already implemented a hosting wide ban for Contabo for this reason. These Amazon EC2 instances are just wasting bandwidth. They are not DOS-ing currently.

I'm contemplating blocking all 300 subnets for Amazon. I have the CPU power to do it. But this is a last resort due to the overhead. I want to see if I can get Ireland blocked off first. I'm blocking 50k to 500k at a time. They will run out of IP addresses eventually. These /13, /14, /15 and /16 subnets I'm blocking are devastating the amount of IP address options available. This is not a game of cat and mouse they can win.