[nsp-sec] DDoS targeting 77.87.225.2

[Thomas Hungenberg]

Hi teams,

there is an ongoing tcp syn flood attack (starting ~ 23.30 UTC last night)
targeting 77.87.225.2:80 (www.deutschland.de).

It appears the source IPs are not spoofed. Most of the sources are within
187/8, 189/8, 190/8, 200/8 and 201/8.

Anyone having any background info on this?


     - Thomas

CERT-Bund Incident Response & Anti-Malware Team