[nsp-sec] DDoS attack towards XS4ALL AS3265

[Dave Monnier]

Thanks for relaying the message, Dave.

We don't see any of the DDoS C2's we're tracking pointed their way.

Will check flows now.

Cheers,
-Dave

On 4/17/12 11:37 AM, Dave Woutersen (NCSC-NL) wrote:
> ----------- nsp-security Confidential --------
> 
> Hi,
> 
> On behalf of xs4all/Jacques Schuurman the following,
> 
> AS3265 has been under a 500 Mbps+ ddos attack as of 10:50 UTC and its
> ongoing right now.
> 
> Main targets 194.109.20.97-99
> 
> traffic type UDP src port 0 dst port 0.
> 
> Does anyone see this traffic? Obviously xs4all would like to see it
> stop, maybe we can pinpoint a C&C in the end by looking at sources.
> Thx in advance!
> Kind regards,
> Dave
> 


-- 
Dave Monnier
Team Cymru
https://www.team-cymru.org/
PGP: https://www.cymru.com/dmonnier/0x7C1AAE55_pub.asc


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 163 bytes
Desc: OpenPGP digital signature
URL: <https://puck.nether.net/mailman/private/nsp-security/attachments/20120417/1e07b65a/attachment-0001.sig>