Hello.
For a few days now we have noticed the reception of thousands of connections in waves from about 500-700 different simultaneous IPs. The characteristics of these IPs are that: 1) they leave the connection in SYN_RECV state for 30 seconds, with the corresponding exhaustion of resources, and 2) they all come from Brazilian subnets.
When asking for support (soyoustart), we cannot install or configure a firewall at the network level (Edge), so they recommend that we apply filtering rules on the server itself.
We have already done this and have identified (so far) 57 subnets.
But this does not eliminate the problem of all this traffic going through OVH...
When speaking to providers in Brazil, they acknowledge that they themselves are being targeted by DDOS and that they will let me know when they manage to control it. But not all providers are responding.
I could post the list of subnets here, but I think OVH would be more interested in removing this traffic from their entire network.
10140 
10.05.2018 18:48
Hey@Aprosi
Yes, the problem you mention is known, even so I recommend that you eventually visit https://www.status-ovhcloud.com/
OVH Anti-DDoS Protection is enabled?
OVH offers a built-in layer of anti-DDoS protection (VAC), but it needs to be configured correctly. Make sure that the DDoS protection profile is active on the OVH dashboard. Set up a profile tailored to legitimate server traffic.
Visit Anti-DDoS : Discover the Best DDoS Protection service
Let me know how it goes,
Sergio Turpín