[AusNOG] Possible DDoS attack against .au governmental sites -~65minutes from now.

[Kooby.net]

Hello,

To save you from visiting the terrible website that apparently contains the 
target addresses you can view this list taken from the site:

"DNS servers: dns3.sge.net, dns2.sge.net, dns.sge.net"

"There are many different sites hosted by the same hosting company that is 
providing internetz for our target:
152.91.62.160
152.91.62.139
152.91.62.145
152.91.62.146
152.91.62.148
152.91.62.161
152.91.62.162
152.92.1.66
152.92.1.68
152.92.1.71
Some DNS Enumeration / Ports Found
205.239.168.16 admin.australia.gov.au
205.239.169.21 dev.australia.gov.au
203.13.0.99 login.australia.gov.au / 80 HTTP, 443 HTTPS
205.239.169.33 mail2.australia.gov.au
205.239.168.11 maps.australia.gov.au / 80 HTTP
202.125.14.244 search.australia.gov.au
205.239.168.15 services.australia.gov.au
205.239.168.13 staging.australia.gov.au
205.239.169.13 test.australia.gov.au
152.91.62.145 www.australia.gov.au / 80 HTTP
media.australia.gov.au alias govsearch-failover.funnelback.com
govsearch-failover.funnelback.com address 122.99.95.165"

Cheers,

Kooby.

----- Original Message ----- 
From: "Bevan Slattery" <Bevan.Slattery at staff.pipenetworks.com>
To: "Roland Dobbins" <rdobbins at arbor.net>
Cc: <ausnog at ausnog.net>
Sent: Wednesday, September 09, 2009 5:57 PM
Subject: Re: [AusNOG] Possible DDoS attack against .au governmental 
sites -~65minutes from now.


> Thanks for the heads up.
>
> Time to sit back and wait for the mrtg graphs tell the story :)
>
> [b]
>
>> -----Original Message-----
>> From: ausnog-bounces at lists.ausnog.net
>> [mailto:ausnog-bounces at lists.ausnog.net] On Behalf Of Roland Dobbins
>> Sent: Wednesday, September 09, 2009 5:56 PM
>> To: ausnog at ausnog.net
>> Subject: [AusNOG] Possible DDoS attack against .au
>> governmental sites - ~65minutes from now.
>>
>>
>> There were some rumblings last week that a DDoS attack
>> against .au governmental sites might take place today in
>> order to protest the
>> Internet filtering plans being posited by the present .au
>> government.
>> I didn't take it very seriously at the time, because no one
>> seemed to have any specifics.
>>
>> This has now changed; it's apparently Anonymous who're
>> supposedly going to do this in about 70 minutes, and they've
>> a considerable track record of mischief, sort of a '4chan
>> Lite'.  I've no idea whether the attacks will actually take
>> place, but heightened vigilance is a good idea, especially as
>> outbound DDoS from botted hosts can be just as disruptive to
>> the networks in question as inbound DDoS.
>>
>> SANS posted something on it here:
>>
>> <http://isc.sans.org/diary.html?storyid=7108>
>>
>> There's an extremely NSFW wiki page being used to coordinate the
>> putative attacks, along with an IRC server/channel.   I'm not
>> going to
>> link to them here, but some digging with various search
>> engines can find them with relative ease.
>>
>> Again, I've no idea whether or not this will actually happen,
>> just a heads-up.
>>
>> --------------------------------------------------------------
>> ---------
>> Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>
>>
>> Sorry, sometimes I mistake your existential crises for
>> technical insights.
>>
>> -- xkcd #625
>>
>> _______________________________________________
>> AusNOG mailing list
>> AusNOG at lists.ausnog.net
>> http://lists.ausnog.net/mailman/listinfo/ausnog
>>
> _______________________________________________
> AusNOG mailing list
> AusNOG at lists.ausnog.net
> http://lists.ausnog.net/mailman/listinfo/ausnog