diff --git a/container_includes/ip_bans/2023-04-25_ddos.txt b/container_includes/ip_bans/2023-04-25_ddos.txt
new file mode 100644
index 0000000000..e827f7aebe
--- /dev/null
+++ b/container_includes/ip_bans/2023-04-25_ddos.txt
@@ -0,0 +1,22 @@
+# There's another ongoing DDoS, but it appears to be Python clients
+
+# Top client appears to be using Python/3.10 aiohttp/3.8.3
+# Second client appears to be using python-urllib3/1.26.12
+# /tts/job/None is the top URL (191M)
+# /tts/queue_length is the second most visited URL (36k)
+
+# /tts/job/None (191M requests, lots of IPs)
+104.251.211.22
+47.253.48.57
+81.56.107.8
+13.234.107.200
+104.247.114.86
+66.214.82.240
+38.25.15.183
+
+# 2600:1700:4d40:4920:ac48:939e:b6c:9e7
+# 2800:bf0:10b:f82:1516:7cdc:974a:17e8
+
+# /tts/queue_length (14k requests, just one IP)
+173.81.41.29
+