[afnog] Africacert opinion on cybersecurity threat Intelligence

[sm+afrinic at elandsys.com]

Hi Logan,
At 10:38 AM 28-09-2026, Loganaden Velvindron wrote:
>I am also noticing spikes of 4 million connections in a single day 
>from 4 IP addresses.

That would be approximately 13,889 connections within a five minute 
window.  It's a high number of connections if they are to a website 
serving static pages.  If it's happening during an entire day, it 
could be a denial of service attack.

>Is this why i am often hitting captcha from certain IP address 
>blocks in the african region ?

Yes.

>Is abuse contact still considered a sufficient mechanism in 2026 ?

The abuse contact for '45.148.10.0 - 45.148.10.255' is 
'dmzhostabuse at gmail.com'.  The abuse reports to the email address 
will end up in the Spam folder as gmail.com would detect the 
information in the report as spam.

The answer to your question is no.  It's not useful if your network 
is experiencing a denial of service attack.

>What is your opinion about whowas ?

Around 11 years ago, a person stated that Whowas was planned for 
implemention.  It is not available yet.  I doubt that it will be 
available within the next two years.  Whowas would not provide the 
type of information you can use to defend against a distributed 
denial of service attack.  I would use Whois to identify the network 
from which the traffic is coming from.

In my opinion, the problem which you described might not be clear to 
other people reading about it as there weren't any technical details 
included with it.

Regards,
S. Moonesamy