Last week, we noticed a lot of traffic towards our LibreDNS - DoT service. CPU and memory usage was pretty high and we saw ~2k concurrent TCP connections. We tried to identify if this was an attack/misconfiguration (client or server) or just increased legitimate traffic. We do not keep logs, so we used the linux Socket Statistics tool (ss) to verify this behaviour. After a day or two, we decided to just scale up this VPS to double cpu/memory as the traffic was identified as legitimate. To all our users, thanks for understanding and for your support in keeping this service up and running for everybody as a mean to bypass censorship and/or protect users from trackers/malware.