[Operators] Reporting DDoS attack, the idiot responsible of the attack and the server range which the drones come from.

[Marco Cirillo]

Approximately from 8:50 am to 8:56 am UTC, my server's muc received something like 1.7 millions stanzas from drones spread across 54 servers.

This is the list of servers is the following:
jabber.fds-net.ru
jabber.justlan.ru
zsh.su
vzljot.ru
kdetalk.net
jabber.nostra.by
jabber.icequake.net
logan-club.ru
jabber.kirovnet.ru
linux.pl
movsoftware.com
jaim.at
jabber.xs4all.nl
oneteam.im
jabber.workaround.org
stopicq.ru
jabber.ofmycity.com
tronet.ru
jabbernet.dk
zlug.asia
jabber.tmkis.com
jabber.typhon.net
jabber.postel.org
fritalk.org
xmpp.us
jabber.uruchie.org
im.apinc.org
jabber.belnet.be
izhnet.org
akl.lt
jabber.psg.com
jabnet.org
jabber80.com
jabber.crimea.ua
kamp.pl
jabber.dn.ua
debianforum.de
jabber.berlin.ccc.de
jab.nazarovo-tel.ru
jabber.murom.net
jabber.meta.net.nz
thesecure.biz
jabber.netrusk.net
alpha-labs.net
jabberworld.net
swissjabber.de
scirus.benran.ru
jwchat.org
jabber.stream.uz
eter.asia
jabber.rdtc.ru
draugr.de
talkers.im
jabber.lg.ua
tsu.tmb.ru
jabber.tanet.ru
jabber.freenet.de





Best Regards,
Marco Cirillo.

r...@jabberworld.net/Mcabber, formally "the idiot", did survey the room and remained in there while the attack was having place. While the above servers have been filtered from accessing components, jabberworld.net has been hex-listed. I do highly encourage the administrators of the servers into the list (if they're subscribed) to employ more rigid safety precautions regarding IBR and monitor more actively what happens in there, so that, excuse the frankness, we don't have to deal with this trash.

smime.p7s
Description: Firma crittografica S/MIME