For a few weeks now we've been seeing IPs from Canada attempting to flood the site. (Thus the crazy member counts!) The main IP involved in this mess it: [b]24.112.8.87[/b]

It's a linux box running a simple DOS script aimed at the website. The ISP info for the user is none other than Canada's most popular ISP.

[red]Domain Name: ROGERS.COM

  Administrative Contact:
     Rogers Shared Services - IT  (AD2981-ORG)  [email protected]
     Rogers Shared Services - IT
     45 Esna Park Drive
     Markham, ON L3R 1C9
     CA
     (905)513-5047 fax: - (905)513-5012
  Technical Contact:
     Technical, Domain  (TD299-ORG) [email protected]
     Rogers Shared Services - IT
     45 Esna Park Drive
     Markham, ON L3R 1C9
     CANADA
     (905)513-5047
     Fax- - - (905)513-5012[/red]


While they are not doing much damage, they are eating up resources (which will change with the upgrade coming in) and they are eating up BW. (Which will change when we block the IP at the firewall.) I have kept the IP free in order to gather as much information on the attacks as possible, I am now tired of doing so as Rogers seems to not care about it.

While I don't enjoy sharing private information like this, the IP above has not stopped their actions and so they are fair game as far as I'm concerned.

The site should only be down for about 10-20 minutes while the update goes in. [=)]

Nukem.

With this info:

Domain Name: ROGERS.COM

Administrative Contact:
Rogers Shared Services - IT (AD2981-ORG) [email protected]
Rogers Shared Services - IT
45 Esna Park Drive
Markham, ON L3R 1C9
CA
(905)513-5047 fax: - (905)513-5012
Technical Contact:
Technical, Domain (TD299-ORG) [email protected]
Rogers Shared Services - IT
45 Esna Park Drive
Markham, ON L3R 1C9
CANADA
(905)513-5047
Fax- - - (905)513-5012




Can we spam them with hate junk email ???[}:D]

Keep in mind that there COULD be a script on thir box being triggered by someone, but since nobody has responded to emails, including their ISP, screw em. [=)]

If you guys noticed, they seem like young kids who are pro gun... most likely they are ignorant and do not know their server has been takin over... either that or they are doing this attack on behalf of another site... [=D]

New security is in place, things shouldn't go nuts anymore under this type of attack.

Yes, how do we "spank them?"  All that "IP" stuff means nothing to me.  I am quite vicious over any attack and would like to know how to make smoke come out of their "VCR-looking thingies" without actually going up there and kicking ass.  Anyone?  [pissed]

Edited to add:  Striker's a one-man ass kicking machine--can we just have him wring some neck?  [}:D]

Crap, it's a big, empty country and would probably be a two month canoe ride over frozen waterways.  hehe  [:D]

Canada eh?!?!?
Rogers eh?!?!

That damn Striker!!! I knew he was a plant.

I'm with ya Boss!

I am quite skilled with the belch, fart, and various other obnoxious things, but I will have to be instructed on how to do the "ping of death."  [devil]

Dont attack these guys, if anything send an email to their ISP regarding this.

[email protected]

If they get 100+ emails, they will maybe reconsider looking into the matter. [=)]

Polite e-mail sent.  Thanks, Boss.

Got this

From: Rogers End User Agreement Team  Save Address | Headers
To: "'[email protected]'"
CC:
Date: Thu, 2 Jan 2003 20:37:00 -0500
Subject: RE: 24.112.8.87 instituting DOS attack
--------------------------------------------------------------------------------

IMPORTANT INFORMATION DO NOT REPLY TO THIS MESSAGE

This is an automatic reply to inform you that your Email has been accepted
by our mail server and is currently queued for review by a Rogers Hi-Speed
Internet EUA Management Team representative.  There is no need to reply to
this notice.  We recommend that you print and/or save this notice for future
reference.

If you are reporting excessive HTTP port probes (80), this activity may be
the result of the worm virus known as "CODE RED VIRUS" or the NIMDA@MM worm
virus. We are currently working on this issue and are contacting our
subscribers that are infected with these worm viruses as quickly as
possible.  For further information regarding the these viruses, please
follow the link below.
http://www.cert.org/advisories/CA-2001-19.html or
http://www.symantec.com/avcenter/venc/data/codered.worm.html

Due to the volume of Email received by the Rogers End Users Agreement
Management Team, we are unable to respond to each Email message individually
particularly if a large group of Rogers subscribers have been impacted.

Please be assured that your concern is being addressed.

For your convenience, we have posted current security-related issues on the
Rogers Hi-Speed Internet Support Website. You can check to see if your
particular concern has been addressed by visiting:

http://www.rogershelp.com

Once the page loads, click the Rogers Hi-Speed Internet Customer Support
Site link in the home page to access Internet Security information. Please
refer back to this page periodically to check for updates.  

Have you directed your complaint properly?

This Email address is used for reporting violations of the Rogers  End User
Agreement committed by a Rogers  subscriber.

Abuse originating from outside the Rogers network should be reported to the
appropriate domain administrator from the domain of the offending IP
address.  We have provided a helpful guide, which will assist in identifying
and reporting the offending party on the customer support site link
mentioned above.

Additionally, you may wish to visit the sites listed below, which provide
helpful tools on obtaining information about a particular host.

http://www.stopspam.org
http://spam.abuse.net
http://www.cauce.org
http://combat.uxn.com
http://www.arin.net/whois/ to indentify contacts for IP numbers.


Additional Requirements for Reporting Acceptable Use Violations


Reporting SPAM (Unsolicited Commercial/Bulk Email)

If you have received SPAM from a Rogers subscriber, please ensure that you
have pasted the full message header along with the body of the message
received within the context of your complaint (no attachments please!) in
plain text format only.  This will ensure that your Email is grouped with
similar complaints and handled at the same time of the occurrence.

Reporting USENET Violations

When reporting a Usenet posting violation by a Rogers subscriber, please
ensure that you include the post in question (no attachments please!) with
the full message header along with a working link to the charter/FAQ of the
discussion group in question.  We will use this link to review the terms and
conditions outlined for the discussion group reported in your complaint.
This will prevent delay in processing your complaint.

Reporting security violations

If you are reporting a security violation by a Rogers subscriber, please
ensure that you include only the relevant log entries within the context of
your complaint that pertain to the offending IP address (no attachments
please!) in plain text format only.  This will ensure that your complaint is
grouped with any possible complaints referring to the same IP address.  Log
entries should contain a time stamp, source IP address, protocol
(TCP/UDP/ICMP) and any applicable ports involved.  We request that you limit
your complaint to one offending IP address per submission.


Note: Rogers is not affiliated with the links provided other than the Rogers
customer support site and are merely providing you with some direction on
obtaining information via third party assistance.  Additionally, please be
aware that Rogers Hi-Speed Internet cannot provide support for these third
party links.

Rogers End Users Agreement Team
Rogers Cable Inc. - (RAAR-12032002).