Yar

Post #299,526 by jake123 11/12/08 11:40:45 AM Reply	Yar http://www.washingto...008111200662.html Good stuff, baby, good stuff. The network loads are down significantly over here....
Post #299,530 by boxley 11/12/08 11:49:34 AM Reply	huge drop
Post #299,536 by jake123 11/12/08 1:40:04 PM Reply	Yeah, it's a tremendous difference over here. Absolutely outstanding.
Post #299,552 by Ashton 11/12/08 5:16:39 PM Reply	Success! stories are so rare -- Any chance that the techniques used to corner these Rat-ISPs -- can actually nip early their next designated spewing place(s)? Surely many fine minds are pondering such matters. Any opinions on whether actual (say 75%?) long-term eradication is now possible? I so iggerant.
Post #299,563 by boxley 11/12/08 8:57:02 PM Reply	ya gotta go after the money but the badge are too busy playing at war agin drugs and terriorists they dont have time to deal with it. So we struggle along with identification and finally after shoving the evidence up the nose of the next hop, the connection will be closed, until someone needs to meet a payroll, office expense, sales quota and hooks them up again
Post #299,710 by mhuber 11/14/08 8:57:00 AM Reply	I thought it was non-point I thought we couldn't do anything real about this kind of stuff because it came from thousands if not millions of sources. Sort of like how you can never make progress killing mosquitoes because there are too many and they reproduce too fast. Looks like a major pool of standing water just got drained. There are times when I don't at all mind being wrong. This is one of them.
Post #299,711 by boxley 11/14/08 8:59:56 AM Reply	it is non pointed attack but the money tree needs to be close to the owners.
Post #299,737 by folkert 11/14/08 5:28:56 PM Reply	Its correct that millions of "bots/zombies" are sprouting... But they have multiple "controllers" that direct traffic and tasks. Many Zombies have a list of IPs or range of IPs to use to look for controllers or payload providers. Many of those IPs were at McColo. Even then, many of those IPs were proxies for the next layer... which were proxies for the (perhaps) starter. Usually its hard to get everything. There might be a slow down, but just as easily as they shutdown the McColo location, there are other places that pick up slack. There will be new trojan/malware compiled and driven/pushed out to all the "existing" listeners (being Zombies etc...) and put on the "normal" suspects. Its a breather, but just to let you know, I just had a vendor have to handle a DDoS again today. So it is not OVER, just a major blow which will recover.
Post #299,740 by boxley 11/14/08 5:47:36 PM Reply	you ever look at tipping point? http://www.tippingpoint.com/
Post #299,770 by folkert 11/15/08 11:50:45 AM Reply	Re: you ever look at tipping point? 6 lines of perl using a hashed array and iptables did just fine.

Welcome to IWETHEY!