On 8/26/03 4:45 PM, "Matthew Sullivan" <[EMAIL PROTECTED]> wrote:
> > George William Herbert wrote: > >> Yes, this is due to a massive DDOS. At least three >> of the spamfilter BLs have been so attacked this week. >> >> Some of the networks represented here have not been >> as timely about helping the BL providers with the >> DDOSes as they could be. Please keep in mind that >> without dynamic BLs anti-spam folks will fall back >> to sending out static block maps, which getting your >> IP space out of will be difficult if not impossible. >> >> IT IS VERY MUCH IN NETWORK OPERATORS >> BEST INTEREST THAT THIS NOT HAPPEN. >> >> Please take what measures are necessary to help >> ensure that your customers are not intentionally >> or neglegently DDOSing the BLs. >> >> > Well said George, > > I have been one of the recepients of the DDoS attacks. If people see > non DNS UDP traffic or non Type 3 ICMP traffic aimed at 203.15.51.32/27 > it is likely DDoS traffic. Currently I still have at least one IP in > that range Null Routed by upstreams. > > SORBS may have to implement a subscription model soon to fund more hosts > around the world if the DDoS's continue, I am desperately trying to > avoid it, should it become nessessary it will be for the +50k > queries/day users out there. The point is SORBS is funded soley by > myself and through hosting dontations - I have 5 public secondaries > donated currently, and I cannot afford, personally, any DDoS proofing > other than that I have now. I know of at least 3 other DNSbls that are > experiencing DDoS issues, and one DNSbl operator that is scared stiff of > DDoS. > > Yours > > Mat > > Note: If anyone wants to talk about SORBS, public secondaries, > donations, policy etc... this is not the forum, please contact me off list. > > > > Hello: If you and others are experiencing DDOS attacks it would be a good idea to get the affected IP's on to the various lists associated with the tracking of such events. If you would like me to post them, I would be happy to do so. Please let me know the IP blocks, other than the one mentioned above, and I will post them to the lists. Thanks, Mike -- Michael K. Smith NoaNet 206.219.7116 (work) 206.579.8360 (cell) [EMAIL PROTECTED] http://www.noanet.net
