[npnog] Fwd: DNS amplification Distributed Denial of Service (DDOS) Attack from multiple IP addresses CERTIn-68022816

[Ajay Mulmi]

Thank you Indiver sir for info.
Regards,


Ajay Mulmi
Pre-sales Team Lead
Yantra Solution
Babar Mahal, Kathmandu
Phone:+977 1 4220745
Mobile: +977 9851115582

---- On Sat, 10 Dec 2016 07:38:55 +0545 ib at indiver.com wrote ----

There are IPs listed for several local ISPs. Best way to notify the 
ISP is to contact their abuse contact obtained by doing a whois on an 
IRR. 

abuse @ vianet.com.np 
abuse_mail @ ntc.net.np 
abuse @ mercantile.com.np 
noc @ subisu.net.np 
abuse @ worldlink.com.np 
abuse @ nettv.com.np 
abuse @ lumbininet.com.np 
abuse @ loopnet.com.np 


Thanks 
Indiver 


On Sat, Dec 10, 2016 at 6:38 AM, Ajay Mulmi via npnog <npnog at npnog.org> wrote: 
> Dear NPNOG members, 
> 
> Please look into this CERTIn request and reply accordingly. 
> 
> BR, 
> 
> 
> Ajay Mulmi 
> 
> 
> ---------- Forwarded message ---------- 
> From: "incident" <incident at cert-in.org.in> 
> Date: 9 Dec 2016 15:57 
> Subject: DNS amplification Distributed Denial of Service (DDOS) Attack from 
> multiple IP addresses CERTIn-68022816 
> To: <info at itsert-np.org> 
> Cc: 
> 
> -----BEGIN PGP SIGNED MESSAGE----- 
> Hash: SHA512 
> 
> Ref: CERTIn-68022816 
> - -------------------- 
> 
> Dear Sir/Madam, 
> 
> We have received a report of DNS amplification DDoS attack against one of 
> our constituent organization, originated from IP addresses which are 
> currently under your control and found to be involved in the attack on 
> December 09, 2016 at 07:25 hrs and December 07,2016 at 07:45 
> hrs(TimeStamp/Zone:IST/GMT+530).
> 
> Relevant IP addresses list is attached with this email. 
> 
> The suspected IP addresses are to be running as open DNS resolver. 
> 
> Such attacks are being carried out by exploiting open or misconfigured 
> domain name servers that allow recursive queries on authoritative or 
> non-authoritative name servers. This allows unauthenticated remote 
> attackers to misuse such publically available open DNS resolvers to 
> carryout large scale amplified Denial of Service (DrDoS) attacks. 
> 
> We kindly request you to get these vulnerable devices patched or 
> appropriately configured to prevent their further misuse. 
> 
> We greatly appreciate your prompt attention to this matter. Kindly intimate 
> us about action taken in this matter at the earliest. 
> 
> 
> 
> - -- 
> Thanks and Regards, 
> 
> CERT-In 
> 
> Incident Response Help Desk 
> e-mail : incident at cert-in.org.in 
> Phone : 1800-11-4949 
> FAX : 1800-11-6969 
> Web : http://www.cert-in.org.in 
> PGP Fingerprint : 4A8F 0BA9 61B1 91D8 8708 7E61 42A4 4F23 2477 855F 
> PGP Key information: 
> http://www.cert-in.org.in/contact.htm 
> 
> Postal address: 
> Indian Computer Emergency Response Team (CERT-In) 
> Ministry of Electronics and Information Technology 
> Government of India 
> Electronics Niketan 
> 6, C.G.O. Complex 
> New Delhi-110 003 
> 
> 
> -----BEGIN PGP SIGNATURE----- 
> Version: Encryption Desktop 10.3.2 (Build 21274) - not licensed for 
> commercial use: www.pgp.com 
> Charset: utf-8 
> 
> wsBVAwUBWEqBPUKkTyMkd4VfAQqHRggAiMY9bgAO4Sv5lmEy2IKOwtWKkPujyioW 
> qilaSalZPPuRjMVVuV3U2HlHfaT7bSmZCemIMGhI2nkrvSMPZjsPXU18RF3Tno8d 
> VSTusJnuBfU9H9ia+pj/Jwj9gHNf2gapzKpo7cx2OggHOTwmC1GwwJp+8l4ASWB6 
> cXep9fbgIVxrlKjpxtLlJ7TvoP6VkJ55rB+kE154xz2gwgEij8O51AsGnweNRr2U 
> 8+q4AfHJhSGosaRHv74A86MNw3jYf4NAphPW8Qfto637oxQlZi9p2YLs1YI/kROh 
> JtElQ+W2pJLEmRvnz3c38S1uIKg3bTm//RoKarVqhoWKbc833l8Bew== 
> =qL3f 
> -----END PGP SIGNATURE----- 
> 
> 
> _______________________________________________ 
> npnog mailing list 
> npnog at npnog.org 
> https://lists.npnog.org/listinfo/npnog 
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.npnog.org/pipermail/npnog/attachments/20161210/fdecbc41/attachment.html>