[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Level3/GC: IMMEDIATE: Trace request on TCP SYN attack traffic towards 22.214.171.124
- Subject: Level3/GC: IMMEDIATE: Trace request on TCP SYN attack traffic towards 126.96.36.199
- From: kauto at huopio.fi (Kauto Huopio)
- Date: Fri, 28 Dec 2012 10:20:30 +0200
(my work hat @ CERT-FI on, work email kauto.huopio at ficora.fi)
Several Finnish media sites (www.yle.fi, www.mtv3.fi, www.hs.fi etc)
have been attacked since Dec 25th.
Current target is www.ampparit.com (188.8.131.52). ISP reports
traffic originating from Level3 transit. Traffic is > 2 Mpps TCP SYN.
I'd like to request immediate trace support - we suspect this is a
very small source
footprint DOS. All observations to cert at ficora.fi, cc: to me at work
Kauto Huopio - kauto at huopio.fi