Is there a club for people that have been DDoSed? If so, count me in. This one was directed at me (as opposed to one of my customers) because I got an e-mail explaining why I was getting DDoSed. Is that aspect common? There were also some racial and sexual accusations that were made that clearly aren't true and just speak to the intelligence of people like this. Is it safe to assume that they completely anonymized the email they sent to me? Is there anyone I should be reporting this to? I thought my site was running in Cloudflare, but my individual server was still attacked, so I gotta figure out where I screwed that up. https://www.dropbox.com/s/rrrx90jvy09h26s/ICS%20DDoS.png?dl=0 ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP
Not an official club, but the unofficial club is full of members including myself unfortunately🙁...little you can do except consider DDoS mitigation service if it continues. It is a criminal activity, so you can report the attack to the FBI...they can't do much to be honest, but at the very least this is good to do in case the problem continues and/or you need to file a business loss with your insurance company barring you have Cyber insurance in your policy. https://www.ic3.gov/Media/Y2017/PSA1710172 Internet Crime Complaint Center (IC3) | Booter and Stresser Services Increase the Scale and Frequency of Distributed Denial of Service Attacks<https://www.ic3.gov/Media/Y2017/PSA1710172> Booter and Stresser Services Increase the Scale and Frequency of Distributed Denial of Service Attacks Criminal actors offer distributed denial of service (DDoS)-for-hire services in criminal forums and marketplaces. www.ic3.gov ________________________________ From: NANOG <nanog-bounces+bclark=peregrinenetworks.net@nanog.org> on behalf of Mike Hammett <nanog@ics-il.net> Sent: Monday, February 8, 2021 6:46 AM To: NANOG list <nanog@nanog.org> Subject: Retalitory DDoS Is there a club for people that have been DDoSed? If so, count me in. This one was directed at me (as opposed to one of my customers) because I got an e-mail explaining why I was getting DDoSed. Is that aspect common? There were also some racial and sexual accusations that were made that clearly aren't true and just speak to the intelligence of people like this. Is it safe to assume that they completely anonymized the email they sent to me? Is there anyone I should be reporting this to? I thought my site was running in Cloudflare, but my individual server was still attacked, so I gotta figure out where I screwed that up. https://www.dropbox.com/s/rrrx90jvy09h26s/ICS%20DDoS.png?dl=0 ----- Mike Hammett Intelligent Computing Solutions<http://www.ics-il.com/> [http://www.ics-il.com/images/fbicon.png]<https://www.facebook.com/ICSIL>[http://www.ics-il.com/images/googleicon.png]<https://plus.google.com/+IntelligentComputingSolutionsDeKalb>[http://www.ics-il.com/images/linkedinicon.png]<https://www.linkedin.com/company/intelligent-computing-solutions>[http://www.ics-il.com/images/twittericon.png]<https://twitter.com/ICSIL> Midwest Internet Exchange<http://www.midwest-ix.com/> [http://www.ics-il.com/images/fbicon.png]<https://www.facebook.com/mdwestix>[http://www.ics-il.com/images/linkedinicon.png]<https://www.linkedin.com/company/midwest-internet-exchange>[http://www.ics-il.com/images/twittericon.png]<https://twitter.com/mdwestix> The Brothers WISP<http://www.thebrotherswisp.com/> [http://www.ics-il.com/images/fbicon.png]<https://www.facebook.com/thebrotherswisp>[http://www.ics-il.com/images/youtubeicon.png]<https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg>
Mike, I've attached the full information we got from our DDOS protection system below. We had a large number of ping loss and data loss tickets begin opening up for devices sharing the cabinet chi18-313. The high traffic and interference was determined to be caused by incoming traffic to the ip address [Not hard to find, but redacted anyway]. Our network engineers will be back in after 9am until 5pm CST. They have greater access to the network and may be able to give you more details. Location : Chicago Event Time : 2021-02-08 04:17:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 2520 Mbps 382880 pps Fragmentation : 11% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 100% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 61% Port # 3702 . 38% Port # 0 Top Destination Port: . 38% Port # 0 . 14% Port # 45934 . 9% Port # 23680 . 8% Port # 35023 . 7% Port # 25966 Top Source IP: . 0% 112.164.127.17 Number of unique IP: 7110 Total Bytes : 1259961437 Total Packets : 1531559 Duration : 4s Report Run Time : 151.3ms The 30 day null route count is: 0 Number of hours to null route : 1 Location : Chicago Event Time : 2021-02-08 04:02:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 1817 Mbps 275483 pps Fragmentation : 13% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 99% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 56% Port # 3702 . 43% Port # 0 Top Destination Port: . 43% Port # 0 . 19% Port # 25966 . 19% Port # 35023 . 17% Port # 23680 Top Source IP: . 0% 90.49.167.239 Number of unique IP: 3577 Total Bytes : 953894831 Total Packets : 1157017 Duration : 4.199s Report Run Time : 306.8ms The 30 day null route count is: 0 Number of hours to null route : 1 Liam Doring Systems Administrator ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP ----- Original Message ----- From: "Mike Hammett" <nanog@ics-il.net> To: "NANOG list" <nanog@nanog.org> Sent: Monday, February 8, 2021 5:46:26 AM Subject: Retalitory DDoS Is there a club for people that have been DDoSed? If so, count me in. This one was directed at me (as opposed to one of my customers) because I got an e-mail explaining why I was getting DDoSed. Is that aspect common? There were also some racial and sexual accusations that were made that clearly aren't true and just speak to the intelligence of people like this. Is it safe to assume that they completely anonymized the email they sent to me? Is there anyone I should be reporting this to? I thought my site was running in Cloudflare, but my individual server was still attacked, so I gotta figure out where I screwed that up. https://www.dropbox.com/s/rrrx90jvy09h26s/ICS%20DDoS.png?dl=0 ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP
Nice report, If you would have to pick up just one vector out of this “multi-vector” attack, which one seems to be the one that had the bigger effect on your network or service? Was it degraded or total service interruption? Jean From: NANOG <nanog-bounces+jean=ddostest.me@nanog.org> On Behalf Of Mike Hammett Sent: February 8, 2021 8:43 AM To: NANOG list <nanog@nanog.org> Subject: Re: Retalitory DDoS Mike, I've attached the full information we got from our DDOS protection system below. We had a large number of ping loss and data loss tickets begin opening up for devices sharing the cabinet chi18-313. The high traffic and interference was determined to be caused by incoming traffic to the ip address [Not hard to find, but redacted anyway]. Our network engineers will be back in after 9am until 5pm CST. They have greater access to the network and may be able to give you more details. Location : Chicago Event Time : 2021-02-08 04:17:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 2520 Mbps 382880 pps Fragmentation : 11% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 100% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 61% Port # 3702 . 38% Port # 0 Top Destination Port: . 38% Port # 0 . 14% Port # 45934 . 9% Port # 23680 . 8% Port # 35023 . 7% Port # 25966 Top Source IP: . 0% 112.164.127.17 Number of unique IP: 7110 Total Bytes : 1259961437 <callto:1259961437> Total Packets : 1531559 Duration : 4s Report Run Time : 151.3ms The 30 day null route count is: 0 Number of hours to null route : 1 Location : Chicago Event Time : 2021-02-08 04:02:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 1817 Mbps 275483 pps Fragmentation : 13% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 99% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 56% Port # 3702 . 43% Port # 0 Top Destination Port: . 43% Port # 0 . 19% Port # 25966 . 19% Port # 35023 . 17% Port # 23680 Top Source IP: . 0% 90.49.167.239 Number of unique IP: 3577 Total Bytes : 953894831 Total Packets : 1157017 Duration : 4.199s Report Run Time : 306.8ms The 30 day null route count is: 0 Number of hours to null route : 1 Liam Doring Systems Administrator ----- Mike Hammett <http://www.ics-il.com/> Intelligent Computing Solutions <https://www.facebook.com/ICSIL> <https://plus.google.com/+IntelligentComputingSolutionsDeKalb> <https://www.linkedin.com/company/intelligent-computing-solutions> <https://twitter.com/ICSIL> <http://www.midwest-ix.com/> Midwest Internet Exchange <https://www.facebook.com/mdwestix> <https://www.linkedin.com/company/midwest-internet-exchange> <https://twitter.com/mdwestix> <http://www.thebrotherswisp.com/> The Brothers WISP <https://www.facebook.com/thebrotherswisp> <https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> _____ From: "Mike Hammett" <nanog@ics-il.net> To: "NANOG list" <nanog@nanog.org> Sent: Monday, February 8, 2021 5:46:26 AM Subject: Retalitory DDoS Is there a club for people that have been DDoSed? If so, count me in. This one was directed at me (as opposed to one of my customers) because I got an e-mail explaining why I was getting DDoSed. Is that aspect common? There were also some racial and sexual accusations that were made that clearly aren't true and just speak to the intelligence of people like this. Is it safe to assume that they completely anonymized the email they sent to me? Is there anyone I should be reporting this to? I thought my site was running in Cloudflare, but my individual server was still attacked, so I gotta figure out where I screwed that up. https://www.dropbox.com/s/rrrx90jvy09h26s/ICS%20DDoS.png?dl=0 ----- Mike Hammett <http://www.ics-il.com/> Intelligent Computing Solutions <https://www.facebook.com/ICSIL> <https://plus.google.com/+IntelligentComputingSolutionsDeKalb> <https://www.linkedin.com/company/intelligent-computing-solutions> <https://twitter.com/ICSIL> <http://www.midwest-ix.com/> Midwest Internet Exchange <https://www.facebook.com/mdwestix> <https://www.linkedin.com/company/midwest-internet-exchange> <https://twitter.com/mdwestix> <http://www.thebrotherswisp.com/> The Brothers WISP <https://www.facebook.com/thebrotherswisp> <https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg>
In my case, it was against a server not on my own network, so my impact was a blackhole for an hour at 4 AM local time. I likely wouldn't have even noticed it, had I not received the threat email, nor the ticket my web host's NOC opened. ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP ----- Original Message ----- From: "Jean St-Laurent" <jean@ddostest.me> To: "Mike Hammett" <nanog@ics-il.net>, "NANOG list" <nanog@nanog.org> Sent: Monday, February 8, 2021 11:42:12 AM Subject: RE: Retalitory DDoS Nice report, If you would have to pick up just one vector out of this “multi-vector” attack, which one seems to be the one that had the bigger effect on your network or service? Was it degraded or total service interruption? Jean From: NANOG <nanog-bounces+jean=ddostest.me@nanog.org> On Behalf Of Mike Hammett Sent: February 8, 2021 8:43 AM To: NANOG list <nanog@nanog.org> Subject: Re: Retalitory DDoS Mike, I've attached the full information we got from our DDOS protection system below. We had a large number of ping loss and data loss tickets begin opening up for devices sharing the cabinet chi18-313. The high traffic and interference was determined to be caused by incoming traffic to the ip address [Not hard to find, but redacted anyway]. Our network engineers will be back in after 9am until 5pm CST. They have greater access to the network and may be able to give you more details. Location : Chicago Event Time : 2021-02-08 04:17:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 2520 Mbps 382880 pps Fragmentation : 11% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 100% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 61% Port # 3702 . 38% Port # 0 Top Destination Port: . 38% Port # 0 . 14% Port # 45934 . 9% Port # 23680 . 8% Port # 35023 . 7% Port # 25966 Top Source IP: . 0% 112.164.127.17 Number of unique IP: 7110 Total Bytes : 1259961437 Total Packets : 1531559 Duration : 4s Report Run Time : 151.3ms The 30 day null route count is: 0 Number of hours to null route : 1 Location : Chicago Event Time : 2021-02-08 04:02:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 1817 Mbps 275483 pps Fragmentation : 13% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 99% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 56% Port # 3702 . 43% Port # 0 Top Destination Port: . 43% Port # 0 . 19% Port # 25966 . 19% Port # 35023 . 17% Port # 23680 Top Source IP: . 0% 90.49.167.239 Number of unique IP: 3577 Total Bytes : 953894831 Total Packets : 1157017 Duration : 4.199s Report Run Time : 306.8ms The 30 day null route count is: 0 Number of hours to null route : 1 Liam Doring Systems Administrator ----- Mike Hammett Intelligent Computing Solutions Image removed by sender.Image removed by sender.Image removed by sender.Image removed by sender. Midwest Internet Exchange Image removed by sender.Image removed by sender.Image removed by sender. The Brothers WISP Image removed by sender.Image removed by sender. ----- Original Message ----- From: "Mike Hammett" <nanog@ics-il.net> To: "NANOG list" <nanog@nanog.org> Sent: Monday, February 8, 2021 5:46:26 AM Subject: Retalitory DDoS Is there a club for people that have been DDoSed? If so, count me in. This one was directed at me (as opposed to one of my customers) because I got an e-mail explaining why I was getting DDoSed. Is that aspect common? There were also some racial and sexual accusations that were made that clearly aren't true and just speak to the intelligence of people like this. Is it safe to assume that they completely anonymized the email they sent to me? Is there anyone I should be reporting this to? I thought my site was running in Cloudflare, but my individual server was still attacked, so I gotta figure out where I screwed that up. https://www.dropbox.com/s/rrrx90jvy09h26s/ICS%20DDoS.png?dl=0 ----- Mike Hammett Intelligent Computing Solutions Image removed by sender.Image removed by sender.Image removed by sender.Image removed by sender. Midwest Internet Exchange Image removed by sender.Image removed by sender.Image removed by sender. The Brothers WISP Image removed by sender.Image removed by sender.
You got RTBH? From: Mike Hammett <nanog@ics-il.net> Sent: February 8, 2021 12:50 PM To: Jean St-Laurent <jean@ddostest.me> Cc: NANOG list <nanog@nanog.org> Subject: Re: Retalitory DDoS In my case, it was against a server not on my own network, so my impact was a blackhole for an hour at 4 AM local time. I likely wouldn't have even noticed it, had I not received the threat email, nor the ticket my web host's NOC opened. ----- Mike Hammett <http://www.ics-il.com/> Intelligent Computing Solutions <https://www.facebook.com/ICSIL> <https://plus.google.com/+IntelligentComputingSolutionsDeKalb> <https://www.linkedin.com/company/intelligent-computing-solutions> <https://twitter.com/ICSIL> <http://www.midwest-ix.com/> Midwest Internet Exchange <https://www.facebook.com/mdwestix> <https://www.linkedin.com/company/midwest-internet-exchange> <https://twitter.com/mdwestix> <http://www.thebrotherswisp.com/> The Brothers WISP <https://www.facebook.com/thebrotherswisp> <https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> _____ From: "Jean St-Laurent" <jean@ddostest.me> To: "Mike Hammett" <nanog@ics-il.net>, "NANOG list" <nanog@nanog.org> Sent: Monday, February 8, 2021 11:42:12 AM Subject: RE: Retalitory DDoS Nice report, If you would have to pick up just one vector out of this “multi-vector” attack, which one seems to be the one that had the bigger effect on your network or service? Was it degraded or total service interruption? Jean From: NANOG <nanog-bounces+jean=ddostest.me@nanog.org> On Behalf Of Mike Hammett Sent: February 8, 2021 8:43 AM To: NANOG list <nanog@nanog.org> Subject: Re: Retalitory DDoS Mike, I've attached the full information we got from our DDOS protection system below. We had a large number of ping loss and data loss tickets begin opening up for devices sharing the cabinet chi18-313. The high traffic and interference was determined to be caused by incoming traffic to the ip address [Not hard to find, but redacted anyway]. Our network engineers will be back in after 9am until 5pm CST. They have greater access to the network and may be able to give you more details. Location : Chicago Event Time : 2021-02-08 04:17:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 2520 Mbps 382880 pps Fragmentation : 11% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 100% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 61% Port # 3702 . 38% Port # 0 Top Destination Port: . 38% Port # 0 . 14% Port # 45934 . 9% Port # 23680 . 8% Port # 35023 . 7% Port # 25966 Top Source IP: . 0% 112.164.127.17 Number of unique IP: 7110 Total Bytes : 1259961437 <callto:1259961437> Total Packets : 1531559 Duration : 4s Report Run Time : 151.3ms The 30 day null route count is: 0 Number of hours to null route : 1 Location : Chicago Event Time : 2021-02-08 04:02:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 1817 Mbps 275483 pps Fragmentation : 13% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 99% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 56% Port # 3702 . 43% Port # 0 Top Destination Port: . 43% Port # 0 . 19% Port # 25966 . 19% Port # 35023 . 17% Port # 23680 Top Source IP: . 0% 90.49.167.239 Number of unique IP: 3577 Total Bytes : 953894831 Total Packets : 1157017 Duration : 4.199s Report Run Time : 306.8ms The 30 day null route count is: 0 Number of hours to null route : 1 Liam Doring Systems Administrator ----- Mike Hammett <http://www.ics-il.com/> Intelligent Computing Solutions <https://www.facebook.com/ICSIL> <https://plus.google.com/+IntelligentComputingSolutionsDeKalb> <https://www.linkedin.com/company/intelligent-computing-solutions> <https://twitter.com/ICSIL> <http://www.midwest-ix.com/> Midwest Internet Exchange <https://www.facebook.com/mdwestix> <https://www.linkedin.com/company/midwest-internet-exchange> <https://twitter.com/mdwestix> <http://www.thebrotherswisp.com/> The Brothers WISP <https://www.facebook.com/thebrotherswisp> <https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> _____ From: "Mike Hammett" <nanog@ics-il.net> To: "NANOG list" <nanog@nanog.org> Sent: Monday, February 8, 2021 5:46:26 AM Subject: Retalitory DDoS Is there a club for people that have been DDoSed? If so, count me in. This one was directed at me (as opposed to one of my customers) because I got an e-mail explaining why I was getting DDoSed. Is that aspect common? There were also some racial and sexual accusations that were made that clearly aren't true and just speak to the intelligence of people like this. Is it safe to assume that they completely anonymized the email they sent to me? Is there anyone I should be reporting this to? I thought my site was running in Cloudflare, but my individual server was still attacked, so I gotta figure out where I screwed that up. https://www.dropbox.com/s/rrrx90jvy09h26s/ICS%20DDoS.png?dl=0 ----- Mike Hammett <http://www.ics-il.com/> Intelligent Computing Solutions <https://www.facebook.com/ICSIL> <https://plus.google.com/+IntelligentComputingSolutionsDeKalb> <https://www.linkedin.com/company/intelligent-computing-solutions> <https://twitter.com/ICSIL> <http://www.midwest-ix.com/> Midwest Internet Exchange <https://www.facebook.com/mdwestix> <https://www.linkedin.com/company/midwest-internet-exchange> <https://twitter.com/mdwestix> <http://www.thebrotherswisp.com/> The Brothers WISP <https://www.facebook.com/thebrotherswisp> <https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg>
I don't have RTBH, no. It's just a web server. Now how my hosting provider handled it, I'm not sure. I don't know if they just dropped me internally, or if they used RTBH with their upstreams and peers. Only being 2.5 gigs, that should be well within their ability to handle internally, but I guess why would you if you didn't have to? ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP ----- Original Message ----- From: "Jean St-Laurent" <jean@ddostest.me> To: "Mike Hammett" <nanog@ics-il.net> Cc: "NANOG list" <nanog@nanog.org> Sent: Monday, February 8, 2021 11:53:43 AM Subject: RE: Retalitory DDoS You got RTBH? From: Mike Hammett <nanog@ics-il.net> Sent: February 8, 2021 12:50 PM To: Jean St-Laurent <jean@ddostest.me> Cc: NANOG list <nanog@nanog.org> Subject: Re: Retalitory DDoS In my case, it was against a server not on my own network, so my impact was a blackhole for an hour at 4 AM local time. I likely wouldn't have even noticed it, had I not received the threat email, nor the ticket my web host's NOC opened. ----- Mike Hammett Intelligent Computing Solutions Image removed by sender.Image removed by sender.Image removed by sender.Image removed by sender. Midwest Internet Exchange Image removed by sender.Image removed by sender.Image removed by sender. The Brothers WISP Image removed by sender.Image removed by sender. ----- Original Message ----- From: "Jean St-Laurent" <jean@ddostest.me> To: "Mike Hammett" <nanog@ics-il.net>, "NANOG list" <nanog@nanog.org> Sent: Monday, February 8, 2021 11:42:12 AM Subject: RE: Retalitory DDoS Nice report, If you would have to pick up just one vector out of this “multi-vector” attack, which one seems to be the one that had the bigger effect on your network or service? Was it degraded or total service interruption? Jean From: NANOG <nanog-bounces+jean=ddostest.me@nanog.org> On Behalf Of Mike Hammett Sent: February 8, 2021 8:43 AM To: NANOG list <nanog@nanog.org> Subject: Re: Retalitory DDoS Mike, I've attached the full information we got from our DDOS protection system below. We had a large number of ping loss and data loss tickets begin opening up for devices sharing the cabinet chi18-313. The high traffic and interference was determined to be caused by incoming traffic to the ip address [Not hard to find, but redacted anyway]. Our network engineers will be back in after 9am until 5pm CST. They have greater access to the network and may be able to give you more details. Location : Chicago Event Time : 2021-02-08 04:17:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 2520 Mbps 382880 pps Fragmentation : 11% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 100% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 61% Port # 3702 . 38% Port # 0 Top Destination Port: . 38% Port # 0 . 14% Port # 45934 . 9% Port # 23680 . 8% Port # 35023 . 7% Port # 25966 Top Source IP: . 0% 112.164.127.17 Number of unique IP: 7110 Total Bytes : 1259961437 Total Packets : 1531559 Duration : 4s Report Run Time : 151.3ms The 30 day null route count is: 0 Number of hours to null route : 1 Location : Chicago Event Time : 2021-02-08 04:02:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 1817 Mbps 275483 pps Fragmentation : 13% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 99% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 56% Port # 3702 . 43% Port # 0 Top Destination Port: . 43% Port # 0 . 19% Port # 25966 . 19% Port # 35023 . 17% Port # 23680 Top Source IP: . 0% 90.49.167.239 Number of unique IP: 3577 Total Bytes : 953894831 Total Packets : 1157017 Duration : 4.199s Report Run Time : 306.8ms The 30 day null route count is: 0 Number of hours to null route : 1 Liam Doring Systems Administrator ----- Mike Hammett Intelligent Computing Solutions Image removed by sender.Image removed by sender.Image removed by sender.Image removed by sender. Midwest Internet Exchange Image removed by sender.Image removed by sender.Image removed by sender. The Brothers WISP Image removed by sender.Image removed by sender. From: "Mike Hammett" <nanog@ics-il.net> To: "NANOG list" <nanog@nanog.org> Sent: Monday, February 8, 2021 5:46:26 AM Subject: Retalitory DDoS Is there a club for people that have been DDoSed? If so, count me in. This one was directed at me (as opposed to one of my customers) because I got an e-mail explaining why I was getting DDoSed. Is that aspect common? There were also some racial and sexual accusations that were made that clearly aren't true and just speak to the intelligence of people like this. Is it safe to assume that they completely anonymized the email they sent to me? Is there anyone I should be reporting this to? I thought my site was running in Cloudflare, but my individual server was still attacked, so I gotta figure out where I screwed that up. https://www.dropbox.com/s/rrrx90jvy09h26s/ICS%20DDoS.png?dl=0 ----- Mike Hammett Intelligent Computing Solutions Image removed by sender.Image removed by sender.Image removed by sender.Image removed by sender. Midwest Internet Exchange Image removed by sender.Image removed by sender.Image removed by sender. The Brothers WISP Image removed by sender.Image removed by sender.
I would not for 2.5 Gbps So if you were down for 1 hour with 2.5 Gbps and it’s probably not a black hole. There might be something else valuable in this report. Maybe 2.5 Gbps is not the damaging factor here unless your server has only 1 Gbps nic, then it could explain. But, I doubt. Peace Jean From: Mike Hammett <nanog@ics-il.net> Sent: February 8, 2021 12:56 PM To: Jean St-Laurent <jean@ddostest.me> Cc: NANOG list <nanog@nanog.org> Subject: Re: Retalitory DDoS I don't have RTBH, no. It's just a web server. Now how my hosting provider handled it, I'm not sure. I don't know if they just dropped me internally, or if they used RTBH with their upstreams and peers. Only being 2.5 gigs, that should be well within their ability to handle internally, but I guess why would you if you didn't have to? ----- Mike Hammett <http://www.ics-il.com/> Intelligent Computing Solutions <https://www.facebook.com/ICSIL> <https://plus.google.com/+IntelligentComputingSolutionsDeKalb> <https://www.linkedin.com/company/intelligent-computing-solutions> <https://twitter.com/ICSIL> <http://www.midwest-ix.com/> Midwest Internet Exchange <https://www.facebook.com/mdwestix> <https://www.linkedin.com/company/midwest-internet-exchange> <https://twitter.com/mdwestix> <http://www.thebrotherswisp.com/> The Brothers WISP <https://www.facebook.com/thebrotherswisp> <https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> _____ From: "Jean St-Laurent" <jean@ddostest.me> To: "Mike Hammett" <nanog@ics-il.net> Cc: "NANOG list" <nanog@nanog.org> Sent: Monday, February 8, 2021 11:53:43 AM Subject: RE: Retalitory DDoS You got RTBH? From: Mike Hammett <nanog@ics-il.net> Sent: February 8, 2021 12:50 PM To: Jean St-Laurent <jean@ddostest.me> Cc: NANOG list <nanog@nanog.org> Subject: Re: Retalitory DDoS In my case, it was against a server not on my own network, so my impact was a blackhole for an hour at 4 AM local time. I likely wouldn't have even noticed it, had I not received the threat email, nor the ticket my web host's NOC opened. ----- Mike Hammett <http://www.ics-il.com/> Intelligent Computing Solutions <https://www.facebook.com/ICSIL> <https://plus.google.com/+IntelligentComputingSolutionsDeKalb> <https://www.linkedin.com/company/intelligent-computing-solutions> <https://twitter.com/ICSIL> <http://www.midwest-ix.com/> Midwest Internet Exchange <https://www.facebook.com/mdwestix> <https://www.linkedin.com/company/midwest-internet-exchange> <https://twitter.com/mdwestix> <http://www.thebrotherswisp.com/> The Brothers WISP <https://www.facebook.com/thebrotherswisp> <https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> _____ From: "Jean St-Laurent" <jean@ddostest.me> To: "Mike Hammett" <nanog@ics-il.net>, "NANOG list" <nanog@nanog.org> Sent: Monday, February 8, 2021 11:42:12 AM Subject: RE: Retalitory DDoS Nice report, If you would have to pick up just one vector out of this “multi-vector” attack, which one seems to be the one that had the bigger effect on your network or service? Was it degraded or total service interruption? Jean From: NANOG <nanog-bounces+jean=ddostest.me@nanog.org> On Behalf Of Mike Hammett Sent: February 8, 2021 8:43 AM To: NANOG list <nanog@nanog.org> Subject: Re: Retalitory DDoS Mike, I've attached the full information we got from our DDOS protection system below. We had a large number of ping loss and data loss tickets begin opening up for devices sharing the cabinet chi18-313. The high traffic and interference was determined to be caused by incoming traffic to the ip address [Not hard to find, but redacted anyway]. Our network engineers will be back in after 9am until 5pm CST. They have greater access to the network and may be able to give you more details. Location : Chicago Event Time : 2021-02-08 04:17:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 2520 Mbps 382880 pps Fragmentation : 11% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 100% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 61% Port # 3702 . 38% Port # 0 Top Destination Port: . 38% Port # 0 . 14% Port # 45934 . 9% Port # 23680 . 8% Port # 35023 . 7% Port # 25966 Top Source IP: . 0% 112.164.127.17 Number of unique IP: 7110 Total Bytes : 1259961437 <callto:1259961437> Total Packets : 1531559 Duration : 4s Report Run Time : 151.3ms The 30 day null route count is: 0 Number of hours to null route : 1 Location : Chicago Event Time : 2021-02-08 04:02:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 1817 Mbps 275483 pps Fragmentation : 13% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 99% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 56% Port # 3702 . 43% Port # 0 Top Destination Port: . 43% Port # 0 . 19% Port # 25966 . 19% Port # 35023 . 17% Port # 23680 Top Source IP: . 0% 90.49.167.239 Number of unique IP: 3577 Total Bytes : 953894831 Total Packets : 1157017 Duration : 4.199s Report Run Time : 306.8ms The 30 day null route count is: 0 Number of hours to null route : 1 Liam Doring Systems Administrator ----- Mike Hammett <http://www.ics-il.com/> Intelligent Computing Solutions <https://www.facebook.com/ICSIL> <https://plus.google.com/+IntelligentComputingSolutionsDeKalb> <https://www.linkedin.com/company/intelligent-computing-solutions> <https://twitter.com/ICSIL> <http://www.midwest-ix.com/> Midwest Internet Exchange <https://www.facebook.com/mdwestix> <https://www.linkedin.com/company/midwest-internet-exchange> <https://twitter.com/mdwestix> <http://www.thebrotherswisp.com/> The Brothers WISP <https://www.facebook.com/thebrotherswisp> <https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> _____ From: "Mike Hammett" <nanog@ics-il.net> To: "NANOG list" <nanog@nanog.org> Sent: Monday, February 8, 2021 5:46:26 AM Subject: Retalitory DDoS Is there a club for people that have been DDoSed? If so, count me in. This one was directed at me (as opposed to one of my customers) because I got an e-mail explaining why I was getting DDoSed. Is that aspect common? There were also some racial and sexual accusations that were made that clearly aren't true and just speak to the intelligence of people like this. Is it safe to assume that they completely anonymized the email they sent to me? Is there anyone I should be reporting this to? I thought my site was running in Cloudflare, but my individual server was still attacked, so I gotta figure out where I screwed that up. https://www.dropbox.com/s/rrrx90jvy09h26s/ICS%20DDoS.png?dl=0 ----- Mike Hammett <http://www.ics-il.com/> Intelligent Computing Solutions <https://www.facebook.com/ICSIL> <https://plus.google.com/+IntelligentComputingSolutionsDeKalb> <https://www.linkedin.com/company/intelligent-computing-solutions> <https://twitter.com/ICSIL> <http://www.midwest-ix.com/> Midwest Internet Exchange <https://www.facebook.com/mdwestix> <https://www.linkedin.com/company/midwest-internet-exchange> <https://twitter.com/mdwestix> <http://www.thebrotherswisp.com/> The Brothers WISP <https://www.facebook.com/thebrotherswisp> <https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg>
It would only be a 1G NIC. They did say it was impacting other users in that rack. No clue how hot or what they run to each rack. ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP ----- Original Message ----- From: "Jean St-Laurent" <jean@ddostest.me> To: "Mike Hammett" <nanog@ics-il.net> Cc: "NANOG list" <nanog@nanog.org> Sent: Monday, February 8, 2021 11:59:32 AM Subject: RE: Retalitory DDoS I would not for 2.5 Gbps So if you were down for 1 hour with 2.5 Gbps and it’s probably not a black hole. There might be something else valuable in this report. Maybe 2.5 Gbps is not the damaging factor here unless your server has only 1 Gbps nic, then it could explain. But, I doubt. Peace Jean From: Mike Hammett <nanog@ics-il.net> Sent: February 8, 2021 12:56 PM To: Jean St-Laurent <jean@ddostest.me> Cc: NANOG list <nanog@nanog.org> Subject: Re: Retalitory DDoS I don't have RTBH, no. It's just a web server. Now how my hosting provider handled it, I'm not sure. I don't know if they just dropped me internally, or if they used RTBH with their upstreams and peers. Only being 2.5 gigs, that should be well within their ability to handle internally, but I guess why would you if you didn't have to? ----- Mike Hammett Intelligent Computing Solutions Image removed by sender.Image removed by sender.Image removed by sender.Image removed by sender. Midwest Internet Exchange Image removed by sender.Image removed by sender.Image removed by sender. The Brothers WISP Image removed by sender.Image removed by sender. ----- Original Message ----- From: "Jean St-Laurent" <jean@ddostest.me> To: "Mike Hammett" <nanog@ics-il.net> Cc: "NANOG list" <nanog@nanog.org> Sent: Monday, February 8, 2021 11:53:43 AM Subject: RE: Retalitory DDoS You got RTBH? From: Mike Hammett <nanog@ics-il.net> Sent: February 8, 2021 12:50 PM To: Jean St-Laurent <jean@ddostest.me> Cc: NANOG list <nanog@nanog.org> Subject: Re: Retalitory DDoS In my case, it was against a server not on my own network, so my impact was a blackhole for an hour at 4 AM local time. I likely wouldn't have even noticed it, had I not received the threat email, nor the ticket my web host's NOC opened. ----- Mike Hammett Intelligent Computing Solutions Image removed by sender.Image removed by sender.Image removed by sender.Image removed by sender. Midwest Internet Exchange Image removed by sender.Image removed by sender.Image removed by sender. The Brothers WISP Image removed by sender.Image removed by sender. From: "Jean St-Laurent" <jean@ddostest.me> To: "Mike Hammett" <nanog@ics-il.net>, "NANOG list" <nanog@nanog.org> Sent: Monday, February 8, 2021 11:42:12 AM Subject: RE: Retalitory DDoS Nice report, If you would have to pick up just one vector out of this “multi-vector” attack, which one seems to be the one that had the bigger effect on your network or service? Was it degraded or total service interruption? Jean From: NANOG <nanog-bounces+jean=ddostest.me@nanog.org> On Behalf Of Mike Hammett Sent: February 8, 2021 8:43 AM To: NANOG list <nanog@nanog.org> Subject: Re: Retalitory DDoS Mike, I've attached the full information we got from our DDOS protection system below. We had a large number of ping loss and data loss tickets begin opening up for devices sharing the cabinet chi18-313. The high traffic and interference was determined to be caused by incoming traffic to the ip address [Not hard to find, but redacted anyway]. Our network engineers will be back in after 9am until 5pm CST. They have greater access to the network and may be able to give you more details. Location : Chicago Event Time : 2021-02-08 04:17:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 2520 Mbps 382880 pps Fragmentation : 11% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 100% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 61% Port # 3702 . 38% Port # 0 Top Destination Port: . 38% Port # 0 . 14% Port # 45934 . 9% Port # 23680 . 8% Port # 35023 . 7% Port # 25966 Top Source IP: . 0% 112.164.127.17 Number of unique IP: 7110 Total Bytes : 1259961437 Total Packets : 1531559 Duration : 4s Report Run Time : 151.3ms The 30 day null route count is: 0 Number of hours to null route : 1 Location : Chicago Event Time : 2021-02-08 04:02:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 1817 Mbps 275483 pps Fragmentation : 13% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 99% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 56% Port # 3702 . 43% Port # 0 Top Destination Port: . 43% Port # 0 . 19% Port # 25966 . 19% Port # 35023 . 17% Port # 23680 Top Source IP: . 0% 90.49.167.239 Number of unique IP: 3577 Total Bytes : 953894831 Total Packets : 1157017 Duration : 4.199s Report Run Time : 306.8ms The 30 day null route count is: 0 Number of hours to null route : 1 Liam Doring Systems Administrator ----- Mike Hammett Intelligent Computing Solutions Image removed by sender.Image removed by sender.Image removed by sender.Image removed by sender. Midwest Internet Exchange Image removed by sender.Image removed by sender.Image removed by sender. The Brothers WISP Image removed by sender.Image removed by sender. From: "Mike Hammett" <nanog@ics-il.net> To: "NANOG list" <nanog@nanog.org> Sent: Monday, February 8, 2021 5:46:26 AM Subject: Retalitory DDoS Is there a club for people that have been DDoSed? If so, count me in. This one was directed at me (as opposed to one of my customers) because I got an e-mail explaining why I was getting DDoSed. Is that aspect common? There were also some racial and sexual accusations that were made that clearly aren't true and just speak to the intelligence of people like this. Is it safe to assume that they completely anonymized the email they sent to me? Is there anyone I should be reporting this to? I thought my site was running in Cloudflare, but my individual server was still attacked, so I gotta figure out where I screwed that up. https://www.dropbox.com/s/rrrx90jvy09h26s/ICS%20DDoS.png?dl=0 ----- Mike Hammett Intelligent Computing Solutions Image removed by sender.Image removed by sender.Image removed by sender.Image removed by sender. Midwest Internet Exchange Image removed by sender.Image removed by sender.Image removed by sender. The Brothers WISP Image removed by sender.Image removed by sender.
Peace, On Mon, Feb 8, 2021 at 2:48 PM Mike Hammett <nanog@ics-il.net> wrote:
I got an e-mail explaining why I was getting DDoSed. Is that aspect common?
Not quite. But it happens sometimes.
Is it safe to assume that they completely anonymized the email they sent to me?
Likely, but not necessarily. Look up the message headers. Your (accurate) description of their intelligence implies they might've failed to anonymize that properly, or they might live in a country that haven't signed extradiction treaties with the U.S. so they don't bother.
Is there anyone I should be reporting this to?
You're not required to, but you can report it to the FBI so that in case those people finally get caught (criminals sometimes make mistakes) their sentence would be a couple years longer. -- Töma
I notice I often get DDoS'd when I post here, to NANOG, usually w/in 2-3 hours, so owing to this note it'll probably happen again tonight! The typical attack is some mixture of DNS whacking from dozens or hundreds of hosts, plus usually UDP packets being flung at basically round-robin ports (udp port 13577, udp port 13578, ...) generating a lot of ICMP unreachables again from hundreds of hosts no doubt all phony. I block it so it's not usually a big big deal other than a brief time waste as I kick in autoblocking I wouldn't want to run all the time but I can see it on for example MRTG, traffic spikes to as much as 10x what I might expect at that time of day. This is a rough neighborhood. "Who steals my bandwidth steals trash" -- William Shakespeare the XIIth -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: +1 617-STD-WRLD | 800-THE-WRLD The World: Since 1989 | A Public Information Utility | *oo*
participants (5)
-
Bret Clark -
bzs＠theworld.com -
Jean St-Laurent -
Mike Hammett -
Töma Gavrichenkov