We are receiving a large load of connections, over 10 million per day, over multiple ports (80, 443, 8080, 8888, and 4072).
This has been going on for 4 days now and it does not look like it is going down.
99.9% of those are blocked at our firewall, a few go to Apache. It is difficult to say how much of our system it uses, I would say less than 3%.
Now, it feels like the attack is not going to stop by itself any time soon. Once you protected your system, do you generally contact the ISPs that "participate" in the attack to ask them to stop the offenders?
The attack encompasses well over 2,000 IP addresses from many different providers. So it looks like a rather daunting task to work on such a large number of people, especially because they generally are suspicious of you rather than the attackers/offenders... (i.e. maybe I'm trying to stop a competitor's business and not a hacker.)
Would there instead be a blacklist place were I can provide all the offending IP addresses?