As a followup to this issue, and looking specifically at SSDP abuse (not the DNS amplification noted in the 1st email), one point of commonality we have identified in many customers is a D-Link device (range of different models). If you or someone you know uses a D-Link device, please see this page as you may need to upgrade your firmware: http://support.dlink.ca/FAQView.aspx?f=sY5vcvfAuAV6bXgi%2F8WoVw%3D%3D As noted last week we're continuing to examine whether / how / when to update our blocked port list. Jason / Comcast