nanog mailing list archives
Re: Ransom DDoS attack - need help!
From: Joe Morgan <joe () joesdatacenter com>
Date: Thu, 10 Dec 2015 00:21:11 -0600
Just an update for those following. We have custom in house software that watches the traffic flows from our edge routers and automatically blackholes any ip getting targeted. The blackhole gets sent upstream which is what we did to maintain the network for our customers during the first attack. We did not suffer any network outage because of the attacks other than our public facing website which honestly is not critical. Since we submitted this thread originally we have gotten two responses from "Armada Collective". One basically a reminder telling us we had 24 hours left to pay. The next came tonight as they were supposed to be hitting us. The second response said they were supposed to be hitting us but decided to give us two more days to get the cash into bitcoin. As of right now we have not replied to them and have no plans to do so. We never had plans to respond or pay them, although telling them whats on my mind sounds appealing. We have contacted the FBI and are working with them providing info. As for protecting our network from future attacks we put all public facing web sites behind Cloudflare and changed the ips from what they were. We left the old ips nulled at our edge and with our providers. We plan to null any ip they decide to hit and and wait it out. As of right now all they have done is take our website offline briefly so not much of a problems as it has not caused our customers issues. Thanks for all the help and info that has been provided and we plan to update this thread as things unfold. I know there are others that have had similar demands (several have reached out off list.) so hopefully the info is useful. -- Thank You, Joe Morgan - Owner Joe's Datacenter, LLC http://joesdatacenter.com 816-726-7615
Current thread:
- Re: Ransom DDoS attack - need help!, (continued)
- Re: Ransom DDoS attack - need help! alvin nanog (Dec 09)
- Re: Ransom DDoS attack - need help! dennis (Dec 03)
- Re: Ransom DDoS attack - need help! Anne Mitchell (Dec 04)
- Re: Ransom DDoS attack - need help! Joe Morgan (Dec 09)
- Re: Ransom DDoS attack - need help! alvin nanog (Dec 09)
- Re: Ransom DDoS attack - need help! Baldur Norddahl (Dec 09)
- Re: Ransom DDoS attack - need help! Baldur Norddahl (Dec 09)
- Re: Ransom DDoS attack - need help! alvin nanog (Dec 09)
- Re: Ransom DDoS attack - need help! Roland Dobbins (Dec 09)
- Re: Ransom DDoS attack - need help! Colin Johnston (Dec 10)
- Re: Ransom DDoS attack - need help! bzs (Dec 10)
- Re: Ransom DDoS attack - need help! Joe Morgan (Dec 09)
- Re: Ransom DDoS attack - need help! Roland Dobbins (Dec 09)
- Re: Ransom DDoS attack - need help! Ian Clark (Dec 10)
- Re: Ransom DDoS attack - need help! Anne Mitchell (Dec 10)
- Re: Ransom DDoS attack - need help! Joe Morgan (Dec 10)
- Re: Ransom DDoS attack - need help! alvin nanog (Dec 10)