Denial of Service attacks resume - Page 4

MeridianR · 05-14-2007, 10:07 AM

Especially now with you being able to go just about anywhere and get a unsecured wireless network

Wireless might be the worst thing that has happened to security in years....

Vaanir · 05-14-2007, 10:21 AM

Quote:

Originally Posted by LFG

Xanadu, is this happening to you again also?

Thank you

Not for a while no.

Nyax · 05-14-2007, 10:47 AM

Odds are its probably just some random guy from some random place just trying to improve his hack skills or some shit.

What you'll need to be carefull of is making sure this isn't a distraction tactic.

Faabio · 05-14-2007, 11:07 AM

It's probably the level lockers from Nagafen, those little shits.

MysidiaDrakkenbane · 05-14-2007, 01:57 PM

I think it's just some kid home for spring break with nothing to do while the servers are down for regular maintenance. As you said, LFG, it comes and goes in spurts. If it's not completely taking down the site, it's nothing to really worry about. I'd rather have a slow site than one that doesn't work. *coughs*EQIIForums*Coughs*

Pepi-Lilly · 05-14-2007, 02:36 PM

I bet its Sony...they are pisst because LFG is taking members from EQ2players so now they are getting back at him!

Ethar · 05-14-2007, 02:49 PM

Well LFG, what I gathered from browsing through that webpage was that even if they themselves cannot help you, they can maybe point you in the right direction to someone who can. You said you didn't have anything to lose by asking whoevers being annoying to e-mail you, so I wouldn't think you'd have anything to lose by at least filing a complaint.

They won't kick in your door for wasting their time! :p

Elenire · 05-14-2007, 04:00 PM

Do a lookup on the IP address to determine who/what company owns it.

I suggest using http://www.dnsstuff.com/ for it. Just scroll down a little ways till you see IP WHOIS lookup.

You should get information on the owners of the IP address blocks and a couple of links next to the owner names. Click these links for detailed owner names, very similar to a WHOIS lookup for a domain name.

Most records will have an Abuse Contact on it. If there is no abuse contact use the administrative contact. Simply use this phone number e-mail address whatever it may be and get in touch with them. If it's sourced from an ISP I can almost guarantee you they'll investigate and stop it. The IP address block owner/ISP will also involve law enforcement if necessary.

Niber · 05-14-2007, 04:18 PM

Quote:

Originally Posted by Elenire

Do a lookup on the IP address to determine who/what company owns it.

I suggest using http://www.dnsstuff.com/ for it. Just scroll down a little ways till you see IP WHOIS lookup.

You should get information on the owners of the IP address blocks and a couple of links next to the owner names. Click these links for detailed owner names, very similar to a WHOIS lookup for a domain name.

Most records will have an Abuse Contact on it. If there is no abuse contact use the administrative contact. Simply use this phone number e-mail address whatever it may be and get in touch with them. If it's sourced from an ISP I can almost guarantee you they'll investigate and stop it. The IP address block owner/ISP will also involve law enforcement if necessary.

It's a SYN attack -- ie. the IP addresses are spoofed.

Law enforcement tends to look at $'s before they intervene. Since this type of attack doesn't cause the damage of a physical intrusion or a DDoS attack there is little motivation for them to get involved.

That said, we're exploring a couple other avenues to curtail the problem. I've implemented a few filters on our end that should help. If anyone has trouble connecting to the site in the next few days please contact either LFG or myself.

Elenire · 05-14-2007, 04:25 PM

Ah didn't see ya say it was SYN.