Corporate PR staffs don't generally work on Sunday, but when AT&T came into the office today they drafted this statement: http://www.att.com/gen/press-room?pid=4800&cdvn=news&newsarticleid=26970 "Beginning Friday, an AT&T customer was impacted by a denial-of-service attack stemming from IP addresses connected to img.4chan.org. To prevent this attack from disrupting service for the impacted AT&T customer, and to prevent the attack from spreading to impact our other customers, AT&T temporarily blocked access to the IP addresses in question for our customers. This action was in no way related to the content at img.4chan.org; our focus was on protecting our customers from malicious traffic. "Overnight Sunday, after we determined the denial-of-service threat no longer existed, AT&T removed the block on the IP addresses in question. We will continue to monitor for denial-of-service activity and any malicious traffic to protect our customers. "Here's more (http://budurl.com/DDoSVideo) on AT&T's efforts to prevent denial-of-service attacks." There's obviously a history of DOS attacks to and from 4chan and the membership over the years, some of it quite righteous. The "Anonymous" attacks against the Cult of Scientology, for example, were very sweet. But all you have to do is read the status page that moot posts on 4chan to realize that they've been the target of a counter-attack for past three weeks or so. Richard Bennett -----Original Message----- From: Seth Mattinen [mailto:sethm@rollernet.us] Sent: Monday, July 27, 2009 3:00 PM To: 'nanog - n. am. network ops group list' Subject: Re: AT&T. Layer 6-8 needed. Richard Bennett wrote:
In the case of the ISPs and carriers who blocked access to 4chan for a while Sunday, since that was done in accordance with DDOS mitigation, there's not any issue as far as the FCC is concerned, but that hasn't prevented the usual parties from complaining about censorship, etc.
If someone came out and said "Hey, DDOS mitigation, please hold!" that would be cool, too. Based on the content of 4chan, it's either DDOS or someone cried about the content. It looked like the latter. ~Seth