relays.osirusoft.com

Tue Aug 26 23:45:37 UTC 2003

George William Herbert wrote:

>Yes, this is due to a massive DDOS.  At least three
>of the spamfilter BLs have been so attacked this week.
>
>Some of the networks represented here have not been
>as timely about helping the BL providers with the
>DDOSes as they could be.  Please keep in mind that
>without dynamic BLs anti-spam folks will fall back
>to sending out static block maps, which getting your
>IP space out of will be difficult if not impossible.
>
>IT IS VERY MUCH IN NETWORK OPERATORS
>BEST INTEREST THAT THIS NOT HAPPEN.
>
>Please take what measures are necessary to help
>ensure that your customers are not intentionally
>or neglegently DDOSing the BLs.
>  
>
Well said George,

I have been one of the recepients of the DDoS attacks.  If people see 
non DNS UDP traffic or non Type 3 ICMP traffic aimed at 203.15.51.32/27 
it is likely DDoS traffic.  Currently I still have at least one IP in 
that range Null Routed by upstreams.

SORBS may have to implement a subscription model soon to fund more hosts 
around the world if the DDoS's continue,  I am desperately trying to 
avoid it, should it become nessessary it will be for the +50k 
queries/day users out there.  The point is SORBS is funded soley by 
myself and through hosting dontations - I have 5 public secondaries 
donated currently, and I cannot afford, personally, any DDoS proofing 
other than that I have now.  I know of at least 3 other DNSbls that are 
experiencing DDoS issues, and one DNSbl operator that is scared stiff of 
DDoS.

Yours

Mat

Note: If anyone wants to talk about SORBS, public secondaries, 
donations, policy etc... this is not the forum, please contact me off list.