10

One of my sites has been getting attacked for over 5 weeks. Im currently employing serverorigin.com proxy services to fight it, since doing it on the server proved to be futile.

They tell me that the attack spikes at 400k packets per second... and sometimes over 3gbit.

Ive had no attempts are communication from anyone, and its been switching to different types of attacks (syn flood, get flood, etc), going up and going down in volume, etc. It seems to be highly distributed, coming from tens of thousands of ips, all over the globe.

My site is not a paid site, and offers free services, and there are no ads on it, so there is no revenue. It gets over 100,000 uniques per day.

Is there anything I can do?

2 Answers2

10

The people who track down DDoS attackers tend to hang out on mailing lists, so your best bet is to search/google for a mailing list using some DDoS related keywords. The reason that the attack is highly distributed is because the attack traffic is coming from a botnet.

There are people who spend a lot of time investigating these botnets and figuring out where the control channel is. If they can crack the control channel, then they can shut the whole thing down. Unfortunately, some attackers just buy a new botnet, or build up their own, and continue attacking.

If you are lucky, you will be able to find a security expert who is interested in collecting your attack data and able to do something about it. They will be interested in a list of every IP address that sends attack, some sample packet captures of different attack modes, and any stats on the attacks.

Try looking at Securiteam particularly on the blogs. Or Google for "Gadi Evron" and see where he hangs out. If you were in the USA I would suggest reporting it to CERT but you are in Canada so try CanCERT.

Michael Dillon
  • 1,819
  • 13
  • 16
  • Any idea where I can find such expert? :p –  Oct 20 '09 at 00:48
  • Gather as much information as you can and make it public of possible. Offer a contact address or, better yet, a discussion area where information can be collected. That way, if someone with the ability to investigate stumbles on your information, he can do useful work on the problem, see what others have done, and so on. – David Schwartz Sep 18 '11 at 01:21
1

If your costs are increasing do to the DDOS attack you can try contacting the FBI (assuming you or your website are US based). It's costing you money to deal with this which makes it something that they can look into if they feel inclined. It probably won't be an easy road. If you aren't in the US check with local law enforcement to see if they can assist in any way.

mrdenny
  • 27,174
  • 4
  • 41
  • 69