[nsp-sec] [FICORA #182723] DDoS towards Habbo BR servers hosted in Canada (69.90.139/24)

[Jose Nazario]

On Mon, 7 Jul 2008, Huopio Kauto wrote:

> We have received a report of a fairly sizeable UDP DDoS towards
> Habbo Hotel (a popular virtual enviroment for kids) Brazil site,
> hosted by peer1 @ Canada. Following addresses:
>
> 69.90.139.111
> .112
> .113
> .114
> .115

no C&Cs but here's the data we have from the past ~day or so.

max_pps 	10277
avg_pps 	8152.33333333
max_dur(s) 	1523
avg_dur 	983.0
max_bps 	112256288
avg_bps 	89004560.0
attacks by date
    72    2008-07-05
2 reporting ISPs 
anonimized sources {'xx.xx.100.178\\/32': 48, 'xx.xx.101.12\\/32': 48}
destinations
    24    69.90.139.119        69.90.139.119
    48    69.90.139.111        69.90.139.111

-------------------------------------------------------------
jose nazario, ph.d.     <jose at arbor.net>
security researcher, office of the CTO,  arbor networks
v: (734) 821 1427 	      http://asert.arbornetworks.com/