DDoS - mpecllc.com UPDATE

SQUID front end seems to be holding thus far.  # of blocked IP's:

 sort /etc/untrusted | uniq | wc -l
      28138 unique IP addresses blocked from site (filtered on robots.txt
and entry.php)

Snippet from the latest log:

1106333459.110      8 66.42.149.182 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333464.230      8 172.186.48.93 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333465.307     17 141.157.73.67 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333466.329     10 69.108.94.194 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333467.307      0 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333467.837    232 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333468.059    116 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333470.710    227 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333471.696      6 69.201.13.69 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333485.337      0 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333485.414      0 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333485.578      4 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333486.255     64 199.176.234.108 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333486.829      9 4.171.156.179 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333488.532      0 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333501.095     22 141.154.45.70 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333501.708    108 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333505.324    111 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333505.779    114 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333506.470      0 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333518.998    118 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333521.013    116 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333521.234      0 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333521.640     60 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333534.662      0 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333536.290      0 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333536.656      0 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333537.093    109 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333540.703      7 67.122.13.211 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333542.783     60 205.241.156.40 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333544.959      9 68.210.104.177 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333559.820     94 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333560.690      0 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333560.935      3 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333561.348     68 64.126.181.48 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333563.480     31 141.154.45.70 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333580.348     11 69.40.100.174 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333585.287      6 69.155.47.247 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html
1106333591.003      6 69.134.132.57 TCP_DENIED/403 427 GET
http://mpecllc.com/robots.txt - NONE/- text/html

I've also filed a report with US Secret Service today.

Havn't heard a word from anyone about the code nature of this attack or if
there are plans to
stop it.

more to come.

 Eschelon Telecom
 AdvancedTelcomInc
UNIX Administration
====================
  [email protected]
  [email protected]

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions