Resolved Icarus Server - Inbound DDoS on 173.248.188.124

[Michael D.]

The IP "173.248.188.124" on the Icarus server has been being hit off and on by decently sized DDoS attacks as of 6:53 AM ET.

The attacks started at around 200 MBPS and have worked their way up to 400 MBPS and they're a combination of TCP SYN floods [HTTP Requests] as well as a DNS Amplification attack on port 53 as well.

Our facility, at this point, has null-routed the IP - we're going to do what we can to restore service to anyone affected.

[Michael D.]

The IP has been re-routed but I cannot guarantee how long this will be the case. We're working on splitting accounts up across a few IPs to limit the impact of the attack as well as to hopefully identify who is under attack. Due to the nature of the attack, it's hitting the IP itself and isn't clearly making it known which site is being attacked.

[anup]

I just about to open a support ticket. Thanks for the update

[Michael D.]

Absolutely. We'll always do what we can to keep as many people online as possible through attacks but at the end of the day we do have to do what is best for our entire client base and network. When things change, we will update this thread.

 

These are the graphs from our primary switching gear, bear in mind that our facility has access to more detailed information and will generally be reporting a larger attack flow than we can see.

 

http://www.screen-shot.net/nw1.png

http://www.screen-shot.net/nw2.png