We are experiencing a DDoS attacking one of our domains - mpecllc.com - UPDATE
"David McCall" <[email protected]>
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <[email protected]> |
Our sandbox'd virtual web server is now front ended by an x836OpenBSD box that is running SQUID for the filtering(up around noon yesterday PST): wc -l /etc/untrusted 19387 /etc/untrusted As you can see the numbers of blocked IP's are growing close to where ipchains was over a week ago. In this case however, SQUID seems to be handling the load quite well, so the Apache server isn't seeing any traffic except that which is NOT robots.txt or entry.php. Also, from a random examination of the newer IP's, this worm has made it around the world rather quickly. Will keep you all updated. David C.McCall UNIX Administrator =================== EschelonTelecom [email protected] [email protected] _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions