<div dir="ltr">I highly doubt NTT or any other major transit provider would ever cut off Korea Telecom or China Telecom. And these are reflectors, they are not part of a botnet.</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Apr 23, 2020 at 5:11 PM TJ Trout <<a href="mailto:tj@pcguys.us">tj@pcguys.us</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><h3 style="overflow:hidden;white-space:nowrap;font-size:0.75rem;margin:inherit;text-overflow:ellipsis;font-family:Roboto,RobotoDraft,Helvetica,Arial,sans-serif;letter-spacing:0.3px;color:rgb(95,99,104);line-height:20px"><span style="outline:none"><span name="Bottiger" style="color:rgb(32,33,36);font-size:0.875rem;display:inline;vertical-align:top;letter-spacing:0.2px;line-height:20px;font-weight:normal">Bottiger,</span></span></h3><div><span style="outline:none"><span name="Bottiger" style="color:rgb(32,33,36);font-size:0.875rem;display:inline;vertical-align:top;letter-spacing:0.2px;line-height:20px"><br></span></span></div><div><span style="outline:none"><span name="Bottiger" style="color:rgb(32,33,36);font-size:0.875rem;display:inline;vertical-align:top;letter-spacing:0.2px;line-height:20px">If what you are saying is true and can be backed by documentation, I would start at the abuse contact for the offending 'Amplifier' and then start working your way up the transits of the offending AS# until someone cuts them off.</span></span></div><div><span style="outline:none"><span name="Bottiger" style="color:rgb(32,33,36);font-size:0.875rem;display:inline;vertical-align:top;letter-spacing:0.2px;line-height:20px">The Squeaky wheel gets the grease!</span></span></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Apr 23, 2020 at 3:33 PM Bottiger <<a href="mailto:bottiger10@gmail.com" target="_blank">bottiger10@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">There are many decent options for ddos protection in the US and Europe, however there are very few in Brazil and Asia that support BGP. Servers and bandwidth in these areas are much more expensive.<div><br></div><div>Even though we are already doing anycast to split up the ddos attack, a majority of the attack traffic is now ending up in these expensive areas, and to top it off, these ISPs won't respond to abuse emails.</div><div><br></div><div>It makes me wonder what the point of these abuse email are and if the regional registries have any power to force them to reply.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Apr 23, 2020 at 3:12 PM Compton, Rich A <<a href="mailto:Rich.Compton@charter.com" target="_blank">Rich.Compton@charter.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div>
<p class="MsoNormal"><span style="font-size:12pt">Good luck with that. </span>
<span style="font-size:12pt;font-family:"Apple Color Emoji"">😊</span><span style="font-size:12pt"> As Damian Menscher has presented at NANOG, even if we do an amazing job and shut down 99% of all DDoS reflectors, there will still be enough bandwidth to
generate terabit size attacks. <a href="https://stats.cybergreen.net" target="_blank">https://stats.cybergreen.net</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:12pt">I think we need to instead collectively focus on stopping the spoofed traffic that allows these attacks to be generated in the first place.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:12pt">-Rich<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:12pt"><u></u> <u></u></span></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12pt;color:black">From: </span></b><span style="font-size:12pt;color:black">NANOG Email List <<a href="mailto:nanog-bounces@nanog.org" target="_blank">nanog-bounces@nanog.org</a>> on behalf of Bottiger <<a href="mailto:bottiger10@gmail.com" target="_blank">bottiger10@gmail.com</a>><br>
<b>Date: </b>Thursday, April 23, 2020 at 3:32 PM<br>
<b>To: </b>Siyuan Miao <<a href="mailto:aveline@misaka.io" target="_blank">aveline@misaka.io</a>><br>
<b>Cc: </b>NANOG list <<a href="mailto:nanog@nanog.org" target="_blank">nanog@nanog.org</a>><br>
<b>Subject: </b>Re: Best way to get foreign ISPs to shut down DDoS reflectors?<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">We are unable to upgrade our bandwidth in those areas. There are no providers within our budget there at the moment. Surely there must be some way to get them to respond.<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Thu, Apr 23, 2020 at 2:23 PM Siyuan Miao <<a href="mailto:aveline@misaka.io" target="_blank">aveline@misaka.io</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">It won't work. <u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Get a good DDoS protection and forget about it.<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Fri, Apr 24, 2020 at 5:17 AM Bottiger <<a href="mailto:bottiger10@gmail.com" target="_blank">bottiger10@gmail.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">Is there a guide on how to get foreign ISPs to shut down reflectors used in DDoS attacks?
<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I've tried sending emails listed under abuse contacts for their regional registries. Either there is none listed, the email is full, email does not exist, or they do not reply. Same results when sending to whatever other email they have
listed.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Example Networks:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">CLARO S.A.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Telefonica<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">China Telecom<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Korea Telecom<u></u><u></u></p>
</div>
</div>
</blockquote>
</div>
</blockquote>
</div>
</div>
The contents of this e-mail message and <br>any attachments are intended solely for the <br>addressee(s) and may contain confidential <br>and/or legally privileged information. If you<br>are not the intended recipient of this message<br>or if this message has been addressed to you <br>in error, please immediately alert the sender<br>by reply e-mail and then delete this message <br>and any attachments. If you are not the <br>intended recipient, you are notified that <br>any use, dissemination, distribution, copying,<br>or storage of this message or any attachment <br>is strictly prohibited.</div>
</blockquote></div>
</blockquote></div>
</blockquote></div>