Re: Abuse from Vodaphone AS30722

[Tom Hill <tom () ninjabadger net>]

On 25/07/2019 14:37, John Von Essen wrote:
> We are experiencing a massive DDoS from three Vodafone /16’s. The DDoS
> is spread throughout the entire range.

You say *Distributed*, from that I would expect that this traffic is
ingressing at multiple locations in your network?

I'd be surprised if Vodafone's domestic Italian network would spread
traffic to your ASN over multiple paths, and so if it is coming in from
multiple ingress points, you're probably looking at spoofed-source traffic.

-- 
Tom