[nsp-sec] List of ssdp-reflection DDoS participants (was: Persistent and escalating DDoS against the Norwegian academic library system provider)

[Rune Sydskjør]

Yes. Sorry about that. Just make sure to remove any reference to nsp-sec. TLP Green!

Regards,
Rune Sydskjør, UNINETT CERT

> Den 10. apr. 2015 kl. 22.43 skrev Smith, Donald <Donald.Smith at CenturyLink.com>:
> 
> Clearly you want us to take action/notify but permission to do so?
> 
> TLP:Green?
> 
> 
> (coffee != sleep) & (!coffee == sleep)
> Donald.Smith at centurylink.com
> 
> 
> 
> From: nsp-security [nsp-security-bounces at puck.nether.net] on behalf of Rune Sydskjor [rune.sydskjor at uninett.no]
> Sent: Thursday, April 09, 2015 3:18 AM
> To: nsp-security at puck.nether.net
> Subject: [nsp-sec] List of ssdp-reflection DDoS participants (was: Persistent and escalating DDoS against the Norwegian academic library system provider)
> 
> 
> ----------- nsp-security Confidential --------
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> Hi teams,
> We had another DDoS against 129.241.16.62:80 this morning.
> Attached is a list of participating ssdp reflection hosts. Timestamp
> is UTC+2. (The same list has been sent to shadowserver.)
> Regards,
> Rune Sydskjør, UNINETT CERT
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
> iD8DBQFVJkPpRY0ei6C6y0kRAvX2AKCEkEuOb96KLYV50tKO+jhvipG9iACfb2HS
> 1NAliLVOPVdjoW1meCMP5Ss=
> =qP3N
> -----END PGP SIGNATURE-----
> This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.