Re: Abuse from Vodaphone AS30722

2019-07-25 Thread Tom Hill 
On 25/07/2019 14:37, John Von Essen wrote:
> We are experiencing a massive DDoS from three Vodafone /16’s. The DDoS
> is spread throughout the entire range.

You say *Distributed*, from that I would expect that this traffic is
ingressing at multiple locations in your network?

I'd be surprised if Vodafone's domestic Italian network would spread
traffic to your ASN over multiple paths, and so if it is coming in from
multiple ingress points, you're probably looking at spoofed-source traffic.

-- 
Tom

Abuse from Vodaphone AS30722

2019-07-25 Thread John Von Essen 
Anyone from Vodaphone on list?

We are experiencing a massive DDoS from three Vodafone /16’s. The DDoS is 
spread throughout the entire range.

2.38.0.0/16
2.39.0.0/16
188.216.0.0/16

We’ve had to block the entire ranges just to stay online.

Thanks
John