Typical ISP complaint
ComCast cut them off around noon on March 10th, just less than a month after the first complaint.
Date: Wed, 09 Mar 2005 21:48:14 -0500
From: Rich Graves
To: abuse@comcast.net
Subject: Continuing DDoS from 68.44.135.87
Since at least February 11th, 2005, your customer at 68.44.135.87
has sent over 25 gigabytes worth of SYN packets towards
www.holocaust-history.org:80.
Do you have any plans to do anything about this?
Times are CST, UTC -0600.
20:47:09.085309 68.44.135.87.3801 > 72.3.135.164.http: S 619466700:619466700(0) win 65535 (DF)
4500 0030 a1a3 4000 6f06 cef9 442c 8757
4803 87a4 0ed9 0050 24ec 4fcc 0000 0000
7002 ffff 6413 0000 0204 05b4 0101 0402
20:47:09.090535 68.44.135.87.3817 > 72.3.135.164.http: S 129633719:129633719(0) win 65535 (DF)
4500 0030 a1a4 4000 6f06 cef8 442c 8757
4803 87a4 0ee9 0050 07ba 0db7 0000 0000
7002 ffff c34a 0000 0204 05b4 0101 0402
20:47:09.090637 68.44.135.87.1097 > 72.3.135.164.http: S 646256981:646256981(0) win 65535 (DF)
4500 0030 a1a5 4000 6f06 cef7 442c 8757
4803 87a4 0449 0050 2685 1955 0000 0000
7002 ffff a381 0000 0204 05b4 0101 0402
Oops, they started again
08:16:01.180002 68.44.135.87.4216 > 72.3.135.164.http: S 3232339034:3232339034(0) win 65535 (DF)
08:16:01.180039 68.44.135.87.1072 > 72.3.135.164.http: S 1821438998:1821438998(0) win 65535 (DF)
08:16:01.180116 68.44.135.87.3824 > 72.3.135.164.http: S 1461791984:1461791984(0) win 65535 (DF)
08:16:01.185191 68.44.135.87.3928 > 72.3.135.164.http: S 447973877:447973877(0) win 65535 (DF)
08:16:01.185290 68.44.135.87.3890 > 72.3.135.164.http: S 2180005904:2180005904(0) win 65535 (DF)
08:16:01.185328 68.44.135.87.3888 > 72.3.135.164.http: S 3949643841:3949643841(0) win 65535 (DF)
08:16:01.185453 68.44.135.87.1059 > 72.3.135.164.http: S 3625366589:3625366589(0) win 65535 (DF)
08:16:01.191749 68.44.135.87.1051 > 72.3.135.164.http: S 2948036268:2948036268(0) win 65535 (DF)
08:16:01.191847 68.44.135.87.1371 > 72.3.135.164.http: S 1767211573:1767211573(0) win 65535 (DF)
08:16:01.191886 68.44.135.87.2863 > 72.3.135.164.http: S 3306631397:3306631397(0) win 65535 (DF)
08:16:01.266675 68.44.135.87.3760 > 72.3.135.164.http: S 3482197521:3482197521(0) win 65535 (DF)
08:16:01.273529 68.44.135.87.3915 > 72.3.135.164.http: S 592262687:592262687(0) win 65535 (DF)
08:16:01.273627 68.44.135.87.2936 > 72.3.135.164.http: S 3305157075:3305157075(0) win 65535 (DF)
08:16:01.273666 68.44.135.87.3919 > 72.3.135.164.http: S 52016145:52016145(0) win 65535 (DF)
08:16:01.273785 68.44.135.87.4339 > 72.3.135.164.http: S 3742673763:3742673763(0) win 65535 (DF)
08:16:01.278280 68.44.135.87.1203 > 72.3.135.164.http: S 848611084:848611084(0) win 65535 (DF)
08:16:01.278379 68.44.135.87.1142 > 72.3.135.164.http: S 2269491769:2269491769(0) win 65535 (DF)
08:16:01.278417 68.44.135.87.3854 > 72.3.135.164.http: S 892088496:892088496(0) win 65535 (DF)
08:16:01.278538 68.44.135.87.1174 > 72.3.135.164.http: S 3017024257:3017024257(0) win 65535 (DF)
08:16:01.283275 68.44.135.87.4002 > 72.3.135.164.http: S 2207313288:2207313288(0) win 65535 (DF)
08:16:01.283374 68.44.135.87.4295 > 72.3.135.164.http: S 948719358:948719358(0) win 65535 (DF)
08:16:01.283412 68.44.135.87.2855 > 72.3.135.164.http: S 2305633323:2305633323(0) win 65535 (DF)
08:16:01.283532 68.44.135.87.3968 > 72.3.135.164.http: S 2441343142:2441343142(0) win 65535 (DF)
08:16:01.290324 68.44.135.87.3857 > 72.3.135.164.http: S 842534319:842534319(0) win 65535 (DF)
08:16:01.290422 68.44.135.87.3980 > 72.3.135.164.http: S 647380354:647380354(0) win 65535 (DF)
08:16:01.290461 68.44.135.87.4006 > 72.3.135.164.http: S 1230187032:1230187032(0) win 65535 (DF)
08:16:01.290581 68.44.135.87.1047 > 72.3.135.164.http: S 3102239814:3102239814(0) win 65535 (DF)
08:16:01.294915 68.44.135.87.3878 > 72.3.135.164.http: S 2914742500:2914742500(0) win 65535 (DF)
08:16:01.295013 68.44.135.87.1064 > 72.3.135.164.http: S 2078167586:2078167586(0) win 65535 (DF)
08:16:01.295051 68.44.135.87.4130 > 72.3.135.164.http: S 2846308338:2846308338(0) win 65535 (DF)