To report a botnet PRIVATELY please email: [EMAIL PROTECTED]
----------
We did not measure packet properties. This attack is still active, but
target is blackholed in our upstream provider. Attackers change target IP
from time to time, within that customer's IP range.
--
Konstantin
On Jan 7, 2008 6:24 AM, Richard Rogerson <[EMAIL PROTECTED]> wrote:
> What size payload? Did you measure the total bandwidth coming in? What
> type of packets were they?
>
>
>
> Interesting none the less…how long did it hold up?
>
>
>
> --
>
>
>
> Richard Rogerson
> ------------------------------
>
> *From:* Konstantin Barinov [mailto:[EMAIL PROTECTED]
> *Sent:* Sunday, January 06, 2008 11:15 PM
> *To:* Richard Rogerson
> *Cc:* botnets@whitestar.linuxbox.org
> *Subject:* Re: [botnets] DDoS we've seen last weekend
>
>
>
>
> Perhaps those were spoofed addresses, I agree. It was about 120K pps.
>
> --
> Konstantin
>
> On Jan 7, 2008 1:32 AM, Richard Rogerson <[EMAIL PROTECTED] > wrote:
>
> Konstantin:
>
>
>
> 3.5M? That's a bit much.. 3.5K rather?.. 3.5M [EMAIL PROTECTED] median =
> ~1Terabit/second
>
>
>
> --
>
> Richard Rogerson
>
>
> ------------------------------
>
> *From:* Konstantin Barinov [mailto:[EMAIL PROTECTED]
> *Sent:* Sunday, January 06, 2008 5:34 PM
> *To:* botnets@whitestar.linuxbox.org
> *Subject:* [botnets] DDoS we've seen last weekend
>
>
>
> Hello!
>
> FYI.
>
> One of our customers with .ro site was under DDoS this weekend. Attack was
> incoming from more tham 3.5M unique IP addresses, all from different C
> classes.
>
> --
> --
> Konstantin Barinov
>
>
>
>
> --
> --
> Konstantin Barinov
>
--
--
Konstantin Barinov
_______________________________________________
To report a botnet PRIVATELY please email: [EMAIL PROTECTED]
All list and server information are public and available to law enforcement
upon request.
http://www.whitestar.linuxbox.org/mailman/listinfo/botnets
