Null routed?

[ZombieToad1]

i today found out i was null routed for getting ddosed i came to this host because i heard they were pretty good at defending against ddoses (and they did for 6 months) but apparently not anymore. is there anyway of finding out who ddosed me and reporting them to the police? also i think my servers reputation is damaged too far but could you remove the nullroute please?

[Edge100x]

ZombieToad1, it won't be possible to determine the attacker from the attack traffic itself. You'd have to look at possible motivations for the attack, threats, and private discussions with potential attackers to try to determine who it might have been.

A single null-route does not indicate that our capabilities have worsened or that an attacker will be able to always take your service offline. You should read our KB article on null-routes here: viewtopic.php?f=25&t=11456.

[ZombieToad1]

You'd have to look at possible motivations for the attack, threats, and private discussions with potential attackers to try to determine who it might have been.

i know exactly who done it but i have no proof

[Edge100x]

If you believe that you have some amount of evidence of a crime that you want to be investigated, you should open a case with law enforcement. In the US, that would be the FBI: https://www.ic3.gov/complaint/default.aspx/

[doulos9]

I am sorry to butt in here, but my server at a different host was getting continual ddos attacks. We knew who we suspected and reported it to law enforcment and the attacks stopped almost immediately. As Edge says you should report it if you have solid evidence (not proof). Maybe just an inquiry from law enforcement will be enough to get the attacker to stop - if is really who you think it is.

[ZombieToad1]

sadly i dont think these attacks are gonna stop and i dont have proof of anyone attacking me so i will probably stop hosting but it was good while it lasted

[ZombieToad1]

also it looks like the attacks got up to 600 Mb/s

[kraze]

also it looks like the attacks got up to 600 Mb/s

What you're seeing would really just be the traffic that made it through before we blocked the attack at a network level.

[ZombieToad1]

all the ips are owned by denic? could you block all denic ips for my ip pls

[kraze]

Assuming the IPs aren't spoofed, you can block these via the Firewall tab in your control panel.

[ZombieToad1]

Assuming the IPs aren't spoofed, you can block these via the Firewall tab in your control panel.

so i blocked all ips 93.*.*.* and it stopped but i hope im not blocking legitimate users

[ZombieToad1]

Assuming the IPs aren't spoofed, you can block these via the Firewall tab in your control panel.

so i blocked all ips 93.*.*.* and it stopped but i hope im not blocking legitimate users

well the attacker caught on and now hes using brazillian ips

i dont think there is any way to fight the attack so im just gonna give up

[Edge100x]

You should have us take a look at it, as well, to see if we can catch anything else.