DDOS Listings

Below is a list of DDOS Alerts that have been collected today. For every alert with a priority of high, medium or info, the following information is displayed ("info" indicates a lower level of threat - either because the volume of the attack is low or undefined):

• The application that detected the alert;
• The geographic location of the Interoute sensor that detected the alert;
• Alert type and DDOS details (for SYNFLOODs, the Bad Guy reference links to a table of Source address);
• Destination IP address (the lower two bytes are masked);
• The date and time of occurrence of the alert.

Where an alert is shown with "Y" in the Src IP Address column, the system has provided further analysis of the attacking addresses (for example, perhaps a small sample of a BotNet). Clicking on the "Y" will reveal analysis showing attacked Port, IP Address, Country of Origin and an indicator to show if it appears in our Bad Guy lists (SBL/XBL, Dshield, Interoute Virtual Darknet etc).

The DDoS attacks are detected by a combination of the Interoute's bespoke software and Peakflow applications. We plan to release Interoute's bespoke system as open source in the future. Peakflow is an industry system.