[nsp-sec] udp/53 floods from AS20773, c&c?

[Dirk Stander]

.: Felix Schueren (Wed, Jul 15, 2009 at 09:50:45AM +0200)
> we've seen a rise in udp/53 floods during the last weeks - I currently
> see smallish ongoing floods (~50k pps) starting ~08:00 CEST to victims
>   211.157.128.33 (AS4808)
>   74.208.2.9 (AS8560 - ns57.1and1.com)

Hi Felix,

we are indeed noticing the packet love :/   peak traffic 1.2M pps.
We are filtering and investigating -- and I'll try to get in contact
with the guys responsible for the supposed C2 (217.79.190.39)

    Thanks and kind regards, Dirk Stander (1&1) :.