<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor=white lang=NL link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span lang=EN-US style='color:#1F497D'>How do you know it’s
a 600mbit … do you know the guy ?<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US style='color:#1F497D'>But yeah Gatekeeper
is right. Write down the IP, grad the log files and mail your and his ISP.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'>
<p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:
"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;
font-family:"Tahoma","sans-serif"'> GateKeeperLL
[mailto:gatekeeper@linkslobby.com] <br>
<b>Sent:</b> maandag 18 augustus 2008 22:38<br>
<b>To:</b> cod@icculus.org<br>
<b>Subject:</b> Re: [cod] ddos attack on port 28960<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>if
it is ddos, you are right it is probably coming from a shell... but still my
method allows the ISP to shut down the connection... again if it is a 600mbit
ddos attack... and you are probably correct in the assumption that it is a
disgruntled killer that was on the server... i deal with this crap all
day lol... cheerz... g8</span><span style='font-size:12.0pt;font-family:
"Times New Roman","serif"'><o:p></o:p></span></p>
</div>
<blockquote style='border:none;border-left:solid black 1.5pt;padding:0cm 0cm 0cm 4.0pt;
margin-left:3.75pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt'>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>-----
Original Message ----- <o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal style='background:#E4E4E4'><b><span style='font-size:10.0pt;
font-family:"Arial","sans-serif"'>From:</span></b><span style='font-size:10.0pt;
font-family:"Arial","sans-serif"'> <a href="mailto:mailinglist@z-grounds.com"
title="mailinglist@z-grounds.com">tommii | Mailinglist</a> <o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>To:</span></b><span
style='font-size:10.0pt;font-family:"Arial","sans-serif"'> <a
href="mailto:cod@icculus.org" title="cod@icculus.org">cod@icculus.org</a> <o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Sent:</span></b><span
style='font-size:10.0pt;font-family:"Arial","sans-serif"'> Monday, August 18,
2008 2:32 PM<o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Subject:</span></b><span
style='font-size:10.0pt;font-family:"Arial","sans-serif"'> RE: [cod] ddos
attack on port 28960<o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p>
</div>
<p class=MsoNormal><span lang=EN-US style='color:#1F497D'>I think this won’t
help.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Did you make somebody
mad on your server or did you ban somebody after a fight ?<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Because this guy is
not sending this DDoS from his own pc.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US style='color:#1F497D'>How did you figure
it’s a ddos ? did your server go down ?<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Tom<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'>
<p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:
"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;
font-family:"Tahoma","sans-serif"'> GateKeeperLL
[mailto:gatekeeper@linkslobby.com] <br>
<b>Sent:</b> maandag 18 augustus 2008 22:28<br>
<b>To:</b> cod@icculus.org<br>
<b>Subject:</b> Re: [cod] ddos attack on port 28960<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<div>
<p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif"'>trace
what ip it is coming from, or block of ip's, whois and find the isp, search
your mp logs and see if the offending ip has been on your server... if he/she
has, document the user name, document when the attacks take place and send all
this info to the offending ip's ISP for action... cheerz g8</span><span
lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p>
</div>
<blockquote style='border:none;border-left:solid black 1.5pt;padding:0cm 0cm 0cm 4.0pt;
margin-left:3.75pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt'>
<div>
<p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif"'>-----
Original Message ----- <o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal style='background:#E4E4E4'><b><span lang=EN-US
style='font-size:10.0pt;font-family:"Arial","sans-serif"'>From:</span></b><span
lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif"'> <a
href="mailto:cheetah@nm.ru" title="cheetah@nm.ru">Cheetah</a> <o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:
"Arial","sans-serif"'>To:</span></b><span lang=EN-US style='font-size:10.0pt;
font-family:"Arial","sans-serif"'> <a href="mailto:cod@icculus.org"
title="cod@icculus.org">cod@icculus.org</a> <o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:
"Arial","sans-serif"'>Sent:</span></b><span lang=EN-US style='font-size:10.0pt;
font-family:"Arial","sans-serif"'> Monday, August 18, 2008 2:09 PM<o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:
"Arial","sans-serif"'>Subject:</span></b><span lang=EN-US style='font-size:
10.0pt;font-family:"Arial","sans-serif"'> [cod] ddos attack on port 28960<o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p>
</div>
<div>
<p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Hey
guys, sorry for my english...<br>
Already second time my servers (server.cod-4.ru) under ddos attacks (600mbit).
Server are running on linux gentoo and with your linux bin
(cod4-linux-server-06282008.tar.bz2). Attacks go to only 28960 port.<br>
Have you any ideas?</span><span lang=EN-US style='font-size:12.0pt;font-family:
"Times New Roman","serif"'><o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif"'> <o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Thanks<br>
CoD-4.ru</span><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif"'> <o:p></o:p></span></p>
</div>
</blockquote>
</blockquote>
</div>
</body>
</html>