New answers tagged

3

Not sure exactly what Arbor Networks provide in terms of DDos their homepage talks about "on-premise solutions". That seldom helps against large DDoS attacks - once the traffic reach your premise, it is already game over. So what to do? Get behind a CDN that offers DDoS protection, and make sure to change your IP so only your CDN and nobody else knows it. ...


0

to clarify, this activity is normal, I see these on other routers as well. Had similar fear, did research. It is a false positive generated by over-broad rulesets.


0

Disconnect the "192.168.1.6" IP address from your router. If your router gateway is "192.168.1.1" then the dos attack log from 192.168.1.6 is another computer connected to your router. If you don't know how to disable it in the router settings, configure a rule in your firewall to block traffic from 192.168.1.6. IF you are in fact experiencing a DoS ...


1

Amplification attacks leverage the asymmetric nature of small amounts of data sent to servers producing a large amount of response towards a target. These are usually performed over protocols for which the source address is easily spoofed. This is not a strict requirement and certainly this could occur on a wide variety of protocols or services but the ...


-1

Do nothing, it's probably a bot sending you that email anyway. They don't know your IP address and won't find out if you don't reply either. Even if they do, you might notice your connection starts lagging out. In that case, simply inform your ISP and request a new IP address, problem solved.


0

Read posts as a stream byte by byte, when you hit the 5MB limit simply return an exception and close the connection. It's not hard to handle requests this way and most up to date web frameworks can do this. As an additional protection log IP addresses and look for flooding / subnets of IP's in rejection logs and then have an instant drop policy in place ...


7

Pay and we will know its you. This is the thing: an empty threat looking exactly like what you have there has been going around, which always has the same bitcoin address in it. In other words: they can't know it's you if you pay, and therefore the threat must be a bluff. Still, hundreds of thousands of dollars have reportedly been sent to that address, ...


-10

To be doubly safe, backup anything to off the network that matters. Better to be overly paranoid than to lose it. Apart from that, yeah it's just junk. They're preying on the known fear of actual ransomware (which has recently been getting a lot of media coverage) to make a quick buck.


0

Short answer: It doesn't really matter. Longer answer follows. What is HSTS anyway? HSTS, or HTTP Strict Transport Security, is an HTTP response header that can be set for web browsers to force TLS connections. A typical header looks like this: Strict-Transport-Security: max-age=31536000; includeSubDomains However, this header alone does not encrypt ...


1

It would be wise to always force the HTTP Strict Transport Security (HSTS) header because the risk of not encrypting may be worse. In this particular case it's a direct tradeoff between confidentiality and availability. For most but not all businesses confidentiality is more important. If your business values the confidentiality more than availability ...


3

Seems like a bluff for all the reasons given in other answers. If they're planning to DDoS you with sheer bandwidth then they aren't just DDoSing you, they'd be attacking the network connection of your VPS. Therefore, even though this attack seems unlikely, it's probably best to inform your VPS vendor that the threat has occurred. They might tell you to ...


5

This threatening email seems to be just that: a threat. You don't have to tolerate it, whatever they will do, this is plain extortion. Report it to: your hosting company, by sending them an original copy of the threatening E-mail (with all headers in their original form. Transfer as an attachment within any professional E-mail client), your national ...


-12

Tell them that you don't negotiate with terrorists and sign up to Cloudflare. Then hope they are just script kiddies. You should inform your ISP so they can monitor it if you think it's a credible threat.


17

If you are in the UK please do this: Message sent by Action Fraud (Action Fraud, Administrator, National) Within the past 24 hours a number of businesses throughout the UK have received extortion demands from a group calling themselves ‘Lizard Squad’. Method of Attack: The group have sent emails demanding payment of 5 Bitcoins, to be paid by a certain ...


51

Ignore it. Cloudflare themselves have stated that these are fake - see https://blog.cloudflare.com/empty-ddos-threats-meet-the-armada-collective/ I highly recommend that you read this article, as it is a very clear explanation from the front line. The armada collective is a real DDOS group, but some con artists are just using their name to try to scare ...


89

Based on the following article you may simply want to ignore it. Seems to be a common scam and your e-mail looks almost exactly like the one in this article. http://arstechnica.com/security/2016/04/businesses-pay-100000-to-ddos-extortionists-who-never-ddos-anyone/ Look up the source ISP of the service provider that sent the e-mail and contact their abuse ...


105

This article might be important for you: https://ca.news.yahoo.com/armada-collective-ddos-threats-were-212413418.html Someone has been copying the Armada Collective's email content to scare people into paying, but no attacks have been recorded. So, possibly, you don't have to do anything.



Top 50 recent answers are included