Screenshots under DDoS attacks

VPNprovider — Sat, 23 Jun 2007 13:08:04 +0800

Screenshots under DDoS attacks

INCIDENT 1: Screenshots became the target of Distributed Denial of Service (DDoS) attacks, making this blog in accessible from 19:30hr June 22 to 00:30hr June 23. The launchpads for the DDoS cyber attackers were traced to two zombies in Russia which were parked at IP addresses 89.169.181.137 (Yubileynyy, Moscow) and 89.163.36.11 (St Petersburg), respectively.

INCIDENT 2: Earlier, Screenshots was also down from 10:00hr to 15:00hr June 22 as a result of a simpler DoS (Denial of Service) attempt via a zombie parked at IP address 202.186.86.222 (Kuala Lumpur), which hosted a cross-border gaming site.

Both DoS and DDoS attackers smack of the modus operandi of SMS Scammers who fake Mobile Originated (MO) requests in the manner they used anonymous networks to create simultaneous, unwarranted traffic to Screenshots server in order to paralyse it, thus denying bona fide readers from reading this weblog.

ACTIONS TAKEN. When Incident 1 happened, Screenshots' web-admin was alerted and immediately activated virtual surveillance of the server activities, and visual inspection of the hardware. The web admin laid out a bait -- by attributing it to a problematic network card as the red herring -- in anticipation of potential DoS and DDoS attacks.

When Incident 2 happened, the zombies were identified and the web admin repelled the attacks systematically at the firewall level.

There were no evidence of server intrusion, and all database of Screenshots remain intact.

MOTIVE. In the event that the two rounds of cyber attacks were triggered by content and issues recently published in Screenshots, one of it stood up like a sore-thumb -- the detailed expose of SMS Scams and the ineffectiveness of MCMC in mitigating the scandal and kill the rogue players.

Digital trails of the DoS attacks via zombie parked at 202.186.86.222 (Kuala Lumpur, Malaysia):

The following hops were tracerouted:

1 ) 62.216.144.5 (United Kingdom)
2 ) 62.216.128.49 (New York, NY, USA)
3 ) 62.216.128.134 (United Kingdom)
4 ) 62.216.128.165 (United Kingdom)
5 ) 62.216.128.33 (United Kingdom)
6 ) 62.216.137.25 (Hong Kong, Hong Kong SAR)
7 ) 62.216.128.182 (Hong Kong, Hong Kong SAR)
8 ) 62.216.128.6 (United Kingdom)
9 ) 62.216.145.66 (United Kingdom)
10 ) 61.6.13.157 (Kuala Lumpur, Malaysia)
11 ) 61.6.162.10 (Kuala Lumpur, Malaysia)
12 ) 161.142.25.85 (Malaysia - imported inetnum object for MIMOS)
13) 61.6.162.10 (Kuala Lumpur, Malaysia)
14 ) Hidden
15 ) 202.186.86.222 (Kuala Lumpur, Malaysia)

Digital trails of the DoS attacks via zombie parked at 89.163.36.11(St Petersburg, Russia):

The following hops were tracerouted:

1 ) 130.117.2.106 (London, UK)
2 ) 130.117.1.62 (London, UK)
3 ) 195.66.226.90 (London, UK)
4 ) 217.106.0.162 (Russia)
5 ) 195.161.4.246 (Russia)
6 ) 195.131.253.53 (Russia)
7 ) Hidden
8 ) 89.163.36.11 (Saint Petersburg, Russia

Digital trails of the DoS attacks via zombie parked at 89.169.181.137 ((Yubileynyy, Moscow, Russia):

The following hops were tracerouted:

1 ) 89.149.186.34 (Germany)
2 ) 213.200.72.38 (Germany)
3 ) 81.222.0.99 (Russia)
4 ) 81.222.0.113 (Russia)
5 ) 81.222.0.90 (Russia)
6 ) 83.217.192.135 (Russia)
7 ) 83.217.192.78 (Russia)
8 ) 89.169.181.137 (Yubileynyy, Moscow, Russia)

Lowyat.NET: Latest topics by VPNprovider

Screenshots under DDoS attacks