North American Network Operators Group|
Date Prev | Date Next |
Date Index |
Thread Index |
Author Index |
- From: Matthew Sullivan
- Date: Tue Aug 26 19:48:11 2003
George William Herbert wrote:
Yes, this is due to a massive DDOS. At least threeWell said George,
of the spamfilter BLs have been so attacked this week.
Some of the networks represented here have not been
as timely about helping the BL providers with the
DDOSes as they could be. Please keep in mind that
without dynamic BLs anti-spam folks will fall back
to sending out static block maps, which getting your
IP space out of will be difficult if not impossible.
IT IS VERY MUCH IN NETWORK OPERATORS
BEST INTEREST THAT THIS NOT HAPPEN.
Please take what measures are necessary to help
ensure that your customers are not intentionally
or neglegently DDOSing the BLs.
I have been one of the recepients of the DDoS attacks. If people see
non DNS UDP traffic or non Type 3 ICMP traffic aimed at 188.8.131.52/27
it is likely DDoS traffic. Currently I still have at least one IP in
that range Null Routed by upstreams.
SORBS may have to implement a subscription model soon to fund more hosts
around the world if the DDoS's continue, I am desperately trying to
avoid it, should it become nessessary it will be for the +50k
queries/day users out there. The point is SORBS is funded soley by
myself and through hosting dontations - I have 5 public secondaries
donated currently, and I cannot afford, personally, any DDoS proofing
other than that I have now. I know of at least 3 other DNSbls that are
experiencing DDoS issues, and one DNSbl operator that is scared stiff of
Note: If anyone wants to talk about SORBS, public secondaries,
donations, policy etc... this is not the forum, please contact me off list.