Re: syn flood attacks from NL-based netblocks

The traffic "from" 88.208.0.0/18, 5.11.80.0/21, and 78.140.128.0/18 doesn't match the packet signatures for Masscan, ZMap, or any other well-known scanner. The traffic is likely spoofed. __ *Troy Mursch* @bad_packets On Fri, Aug 16, 2019 at 3:28 PM Jared Smith wrote: > I would

Re: Russian Anal Probing + Malware

AS202425 = AS29073. Formerly known as Quasi Networks / Ecatel. See previous NANOG thread here: https://mailman.nanog.org/pipermail/nanog/2017-August/091956.html On Sat, Jun 22, 2019 at 10:03 AM Keith Medcalf wrote: > On Friday, 21 June, 2019 18:14, Ronald F. Guilmette > wrote: > > >

Re: Whats going on at Cogent

+AND+location.country_code%3A+US%29+AND+autonomous_system.description.raw%3A+%22COGENT-174+-+Cogent+Communications%22; __ *Troy Mursch* On Thu, Oct 18, 2018 at 12:05 PM Aaron Gould wrote: > I guess those bots have to sit somewhere. I don’t know that they would be > in routers a

Re: Attacks from poneytelecom.eu

://twitter.com/ba d_packets/status/937220987371732992 Thanks, __ *Troy Mursch* @bad_packets <https://twitter.com/bad_packets> On Tue, Jan 2, 2018 at 6:51 PM, Dovid Bender <do...@telecurve.com> wrote: > Hi All, > > Lately we have seen a lot of attacks from IPs wher

Re: AS29073, 196.16.0.0/14, Level3: Why does anyone peer with these schmucks?

can submit it via this web form: https://stichtingbrein.nl/contact.php __ *Troy Mursch* Bad Packets Report <https://badpackets.net/> (702) 509-1248 On Mon, Aug 14, 2017 at 1:17 PM, Siegel, David <dave.sie...@level3.com> wrote: > If you believe that a customer of a network service p