[nsp-sec] another ddos net: x.arabhell.net/69.42.216.120/port 6703/US/AS17048

[Jose Nazario]

these aren't exactly high profile targets but you get the idea :

1203013673/x.arabhell.net/69.42.216.120/6703/US/17048/##GothicF##//91.140.210.233/91.140.210.233/KW/3225/|BaD|BoY|!evil@
feeling.nasty/ARBOR/ .ddos.udp 91.140.210.233 1000 65000 1000
1203016554/x.arabhell.net/69.42.216.120/6703/US/17048/##GothicF##//91.140.201.236/91.140.201.236/KW/3225/|BaD|BoY|!evil@
feeling.nasty/ARBOR/ .ddos.udp 91.140.201.236 1000 65000 1000
1203016638/x.arabhell.net/69.42.216.120/6703/US/17048/##GothicF##//62.215.37.73/62.215.37.73/KW/21050/|BaD|BoY|!evil at fee
ling.nasty/ARBOR/ .ddos.udp 62.215.37.73 1000 65000 1000
1203017053/x.arabhell.net/69.42.216.120/6703/US/17048/##GothicF##//62.215.37.73/62.215.37.73/KW/21050/|BaD|BoY|!evil at fee
ling.nasty/ARBOR/ .ddos.udp 62.215.37.73 1000 65000 1000
1203017388/x.arabhell.net/69.42.216.120/6703/US/17048/##GothicF##//62.215.16.140/62.215.16.140/KW/21050/|BaD|BoY|!evil at f
eeling.nasty/ARBOR/ .ddos.udp 62.215.16.140 1000 65000 1000


etc etc etc

timestamp/name/ip/port/cc/asn/channel//victim/../cmd

anyone in a position to shut this one down?


-- 
-------------------------------------------------------------
jose nazario, ph.d.     <jose at arbor.net>
security researcher, office of the CTO,  arbor networks
v: (734) 821 1427 	      http://asert.arbornetworks.com/