To report a botnet PRIVATELY please email: [EMAIL PROTECTED] ---------- Well, I did a grep through my log but I did not find them.
Kind regards Peter and Karin Dambier -------- Original Message -------- Return-Path: <[EMAIL PROTECTED]> From: mack <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] <[EMAIL PROTECTED]> Date: Tue, 20 Nov 2007 11:02:34 -0600 Subject: Reflection Attack- 69.80.239.50 Thread-Topic: Reflection Attack- 69.80.239.50 Thread-Index: AcgrMP/hT1m/PgWJT6Wp6CkOGviIjAAZfl4w Message-ID: <[EMAIL PROTECTED]> I apologize if this is off topic. Currently the IP 69.80.239.50 is the victim of a reflection attack. Many operators may be seeing what appears to be a syn attack generated by this IP. These are actually spoofed packet hitting an open port designed to generate a syn-ack packet at the victim server. This attack was originally a standard syn attack which has lasted since the 13th. On Saturday the 17th we moved the victim server to a new ip behind a firewall. Yesterday, Monday the 19th at approximately 3PM the attack changed to a reflection attack of greatly increased magnitude. We have rate limited syn-ack packets hitting the firewall to reduce backscatter of reset packets. Anyone seeing a stream of packets that appears to be improperly sourced from 69.80.239.50 is asked to contact us if they believe they can help us track back the perpetrators. Any assistance that can be rendered is appreciated. This includes direction to another forum that may be able to offer assistance. As there are approximately 102,000 reflectors being used please do not contact us unless you can help us trace this back or provide substantial assistance. We are currently overwhelmed by abuse complaints this has generated. The attack has now doubled in size and may be considerably more than 102k reflectors. ---- LR Mack McBride Network Administrator Alpha Red, Inc. -- Peter and Karin Dambier Cesidian Root - Radice Cesidiana Rimbacher Strasse 16 D-69509 Moerlenbach-Bonsweiher +49(6209)795-816 (Telekom) +49(6252)750-308 (VoIP: sipgate.de) mail: [EMAIL PROTECTED] mail: [EMAIL PROTECTED] http://iason.site.voila.fr/ https://sourceforge.net/projects/iason/ http://www.cesidianroot.com/ _______________________________________________ To report a botnet PRIVATELY please email: [EMAIL PROTECTED] All list and server information are public and available to law enforcement upon request. http://www.whitestar.linuxbox.org/mailman/listinfo/botnets
