[nsp-sec] DDOS target www.civil.ge 1Gbps 220kpps http mixed with udp

[Hillar Aarelaid]

Hi

It has been quiet for a while

target www.civil.ge

today started  19:02 (+0300) with HTTP GETs S

"GET /eng/ HTTP/1.1" 200 0 "-" "-"

mixed with UDP to port 80

there was a change at 20:02 (+0300) POST was added

"POST /eng/ HTTP/1.1" 400 0 "-" "-"

POST /eng/ HTTP/1.1
Host: civil.ge
User-Agent:
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Keep-Alive: 300
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 1024
application/x-www-form-urlencoded

data is 0x00 around 1024 bytes



Hillar