But they have multiple "controllers" that direct traffic and tasks.

Many Zombies have a list of IPs or range of IPs to use to look for controllers or payload providers.

Many of those IPs were at McColo. Even then, many of those IPs were proxies for the next layer... which were proxies for the (perhaps) starter.

Usually its hard to get everything. There might be a slow down, but just as easily as they shutdown the McColo location, there are other places that pick up slack.

There will be new trojan/malware compiled and driven/pushed out to all the "existing" listeners (being Zombies etc...) and put on the "normal" suspects.

Its a breather, but just to let you know, I just had a vendor have to handle a DDoS again today. So it is not *OVER*, just a major blow which will recover.

6 lines of perl using a hashed array and iptables did just fine.