Level3/GC: IMMEDIATE: Trace request on TCP SYN attack traffic towards 217.149.58.35

Greetings, (my work hat @ CERT-FI on, work email kauto.huopio@ficora.fi) Several Finnish media sites (www.yle.fi, www.mtv3.fi, www.hs.fi etc) have been attacked since Dec 25th. Current target is www.ampparit.com (217.149.58.35). ISP reports traffic originating from Level3 transit. Traffic is > 2 Mpps TCP SYN. I'd like to request immediate trace support - we suspect this is a very small source footprint DOS. All observations to cert@ficora.fi, cc: to me at work address above. -- Kauto Huopio - kauto@huopio.fi