On Thu, Apr 02, 2020 at 05:12:29PM +0800, Tessa Plum <tessa at plum.ovh> wrote a message of 11 lines which said: > All the packages were DNS requests, some queries like 'dig domain.com any'. > but their IP address seems spoofed. In that case, yes, RRL would help.