[nsp-sec] AT&T blackholing IPs

[Serge Droz]

Hi Rob,

thanks for sharing. I've informed affected Swiss Networkoperators.

Sofar I got one feedback:

25563 92.43.216.135  Webland AG

has been cleaned

Serge


On 9.10.12 22:15 , FORSTER, ROB wrote:
> ----------- nsp-security Confidential --------
> 
> 
> 
> AT&T (AS7108) is blackholing around 800 IP addresses as sources of attacks against our customers.
> Most, if not all, of these are web servers.
> The two attached Excel files are sorted by ASN.
> Please let me know when the systems have been remediated.
> We can then arrange to remove the IP from the blocks.
> Please email me if you have any questions or the IP has been fixed.
> 
> 
> 
> Thanks.
> 
> Rob Forster
> AT&T
> rf1542 at att.com
> 
> 
> 
> 
> 
> 
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
> 
> Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
> community. Confidentiality is essential for effective Internet security counter-measures.
> _______________________________________________
> 


-- 
SWITCH
-----------------------
Dr. Serge Droz, Team Leader Security
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
phone +41 44 268 15 63, fax +41 44 268 15 78
serge.droz at switch.ch, http://www.switch.ch