Potential Malicious Peer in P2P Downloading: A Countermeasure Against Concealed IP Address

While monitoring a torrent download, I unexpectedly discovered a malicious peer attempting to flood the upload traffic using a client that conceals its IP address. Upon further investigation, I found that the IP address was an internal network address (10.1.xx.xx) which is automatically trusted by default. This internal address belongs to my Kubernetes vxlan-calico address, which I identified using a utility called iftop. I also found that the malicious peer's IP address is 58.216.63.0/24. The client uses aria2/1.33.1 and qBittorrent 4.6.3 with multiple IP addresses simultaneously. To resolve this issue, I removed the internal addresses from the ignore-peers-from-addresses field in the PBH configuration file.