Ransom DDoS attack - need help!

Thu Dec 10 06:21:11 UTC 2015

Just an update for those following. We have custom in house software that
watches the traffic flows from our edge routers and automatically
blackholes any ip getting targeted. The blackhole gets sent upstream which
is what we did to maintain the network for our customers during the first
attack. We did not suffer any network outage because of the attacks other
than our public facing website which honestly is not critical. Since we
submitted this thread originally we have gotten two responses from "Armada
Collective". One basically a reminder telling us we had 24 hours left to
pay. The next came tonight as they were supposed to be hitting us.  The
second response said they were supposed to be hitting us but decided to
give us two more days to get the cash into bitcoin. As of right now we have
not replied to them and have no plans to do so. We never had plans to
respond or pay them, although telling them whats on my mind sounds
appealing. We have contacted the FBI and are working with them providing
info. As for protecting our network from future attacks we put all public
facing web sites behind Cloudflare and changed the ips from what they were.
We left the old ips nulled at our edge and with our providers. We plan to
null any ip they decide to hit and and wait it out. As of right now all
they have done is take our website offline briefly so not much of a
problems as it has not caused our customers issues. Thanks for all the help
and info that has been provided and we plan to update this thread as things
unfold. I know there are others that have had similar demands (several have
reached out off list.) so hopefully the info is useful.

-- 
Thank You,
Joe Morgan - Owner
Joe's Datacenter, LLC
http://joesdatacenter.com
816-726-7615