Hi all, I'm looking for someone at Comcast who works on the Xfinity CyberSecure (formerly xFi Advanced Security) IP reputation list, or who can route this to the right team. We run SurgeNode, a small game-server host. CyberSecure is blocking two of our IPs (announced by our upstream, AME Hosting / bloom.host, AS399244) for Xfinity subscribers: 170.205.24.84 (va4.surgenode.net) 170.205.24.153 The block is on the IP itself, so the spa.xfinity.com form (which only accepts URLs) comes back as "no block found", and the CSA phone team refers customers back to us as the host. We believe the IPs were flagged because of spoofed-source traffic during DDoS attacks against a game server we host, not traffic originating from it: - AbuseIPDB reports for .84 (Sep 12-17) show SYNs "from" our IP to tcp/30120 with TTLs ranging 36-57 and widely varying window sizes within minutes of each other - The remaining reports are "port scans" and MySQL/SSH probes from our IP to third-party hosts, which matches SYN-ACK reflection: spoofed SYNs sent in our name so the replies flood us - Other reports show backscatter from our tcp/30120 to random high ports - The most recent report (Oct 18) is a DNS flood, consistent with a DNS reflection attack against us - 170.205.24.153 has no AbuseIPDB reports at all, so its block may be range-based or come from a different feed We've requested takedown of the AbuseIPDB reports and are happy to share packet captures and traffic logs off-list. Several hundred of our players on Xfinity currently can't connect, so any pointer to the right contact would be much appreciated. Thanks, Director, SurgeNode Ltd mail@surgenode.net