http://www.washingto...008111200662.html
Good stuff, baby, good stuff. The network loads are down significantly over here....
![]() http://www.washingto...008111200662.html
Good stuff, baby, good stuff. The network loads are down significantly over here.... |
|
![]() |
|
![]() Absolutely outstanding.
|
|
![]() Any chance that the techniques used to corner these Rat-ISPs -- can actually nip early their next designated spewing place(s)? Surely many fine minds are pondering such matters.
Any opinions on whether actual (say 75%?) long-term eradication is now possible? I so iggerant. |
|
![]() but the badge are too busy playing at war agin drugs and terriorists they dont have time to deal with it. So we struggle along with identification and finally after shoving the evidence up the nose of the next hop, the connection will be closed, until someone needs to meet a payroll, office expense, sales quota and hooks them up again
|
|
![]() I thought we couldn't do anything real about this kind of stuff because it came from thousands if not millions of sources.
Sort of like how you can never make progress killing mosquitoes because there are too many and they reproduce too fast. Looks like a major pool of standing water just got drained. There are times when I don't at all mind being wrong. This is one of them. |
|
![]() but the money tree needs to be close to the owners.
|
|
![]() But they have multiple "controllers" that direct traffic and tasks.
Many Zombies have a list of IPs or range of IPs to use to look for controllers or payload providers. Many of those IPs were at McColo. Even then, many of those IPs were proxies for the next layer... which were proxies for the (perhaps) starter. Usually its hard to get everything. There might be a slow down, but just as easily as they shutdown the McColo location, there are other places that pick up slack. There will be new trojan/malware compiled and driven/pushed out to all the "existing" listeners (being Zombies etc...) and put on the "normal" suspects. Its a breather, but just to let you know, I just had a vendor have to handle a DDoS again today. So it is not *OVER*, just a major blow which will recover. |
|
![]() |
|
![]() 6 lines of perl using a hashed array and iptables did just fine.
|