Level3/GC: IMMEDIATE: Trace request on TCP SYN attack traffic towards 217.149.58.35

[Kauto Huopio <kauto () huopio fi>]

Greetings,

(my work hat @ CERT-FI on, work email kauto.huopio () ficora fi)

Several Finnish media sites (www.yle.fi, www.mtv3.fi, www.hs.fi etc)
have been attacked since Dec 25th.

Current target is www.ampparit.com (217.149.58.35).  ISP reports
traffic originating from Level3 transit. Traffic is > 2 Mpps TCP SYN.

I'd like to request immediate trace support - we suspect this is a
very small source
footprint DOS. All observations to cert () ficora fi, cc: to me at work
address above.

-- 
Kauto Huopio - kauto () huopio fi