DDoS Attacks - IPs Sharing

[Dodo]

[Last Updated: 31/10 14:15]

Hello' People,

Recently Beyond Servers has been under DoS attacks.
These attacks are not high enough to trigger most of hosts DDoS deffensive systems as it'd not be powerful enough to make the whole box lagg.
However, it is enough to make your game server lagg (between 500 & 800 of ping). About 120 of those IPs were harvested during attacks towards Beyond Servers.

Will be added here all the IPs that were, are and will attack the services provided by our company, these IPs are automatically detected.
You are free to do whatever you want with it however it is strongly advised you block those, to do so, I added a script so you can easily block them all in two clicks.

Note: If you do not have a direct access to the server box, you should directly ask your host.


Attacking IP List (DoS):

Spoiler

31.28.40.62
109.226.69.167
85.114.178.4
213.178.36.36
85.114.165.95
62.106.110.63
85.114.177.30
109.226.94.62
109.226.112.101
188.122.232.158
109.226.108.151
31.28.35.45
188.122.232.82
213.178.36.83
5.28.19.222
85.114.184.183
31.28.37.107
109.226.113.129
85.114.181.241
81.28.183.173
188.122.246.127
213.59.112.43
188.122.241.167
62.106.98.30
31.28.63.14
109.226.113.152
31.28.62.157
85.114.163.157
109.226.82.166
109.226.81.163
5.28.18.132
109.226.96.244
81.177.215.185
109.226.124.248
109.226.126.186
5.28.19.252
188.122.238.192
109.226.85.206
188.122.227.245
188.122.225.8
188.122.253.16
31.28.57.1
31.28.59.178
188.122.234.58
213.178.36.146
188.122.224.97
62.106.102.189
85.114.173.254
109.226.94.5
31.28.32.229
92.240.140.153
213.59.115.50
85.114.161.236
31.28.41.20
188.122.255.24
31.28.42.157
31.28.35.249
188.122.238.179
81.177.211.107
81.177.210.99
31.28.62.225
109.226.65.94
109.226.72.6
31.28.62.122
62.106.113.143
188.122.239.141
5.28.18.194
92.240.140.34
109.226.111.119
85.114.187.190
109.226.120.209
5.28.17.148
31.28.37.87
31.28.34.89
109.226.120.198
109.226.121.185
188.122.251.45
85.114.179.81
92.240.135.102
81.177.215.95
85.114.177.68
5.28.28.250
81.177.213.0
188.122.224.106
188.122.244.43
92.240.134.98
81.177.214.16
188.122.255.14
31.28.49.26
31.28.61.38
109.226.116.19
81.177.221.49
109.226.87.98
5.28.16.102
31.28.59.65
81.177.220.187
85.114.180.158
81.177.222.142
31.28.63.66
62.106.106.246
109.226.96.171
92.240.129.248
188.122.251.170
62.106.105.106
92.240.139.208
81.177.210.161
109.226.64.206
31.28.45.239
109.226.123.229
188.122.244.233
109.226.64.6
62.106.110.177
92.240.142.89
85.114.170.159
31.28.58.115
5.28.28.50
92.240.130.35
31.28.34.98
109.226.88.55
81.28.187.232
31.28.39.8
109.226.91.200
92.240.128.164
5.28.31.140
5.28.25.99
109.226.110.40

[close]

How to ban (Linux - iptables):

In this example, we have a file called 'ips.list' where all the IPs above were dump.
We'll also create a file that'll read this file and banned all the IPs listed.

• Create a file, it'll be called 'banIPs.sh': $ touch banIPs.sh
• Insert the following script in 'banIPs.sh':
  
  Spoiler

  #! /bin/bash
  
  if [[ -z $1 ]]; then
    echo "USAGE: $0 <file>"
    exit
  fi
  
  counter=0
  
  echo "Blocking IPs..."
  echo
  
  while read -r line; do
    if ! [[ $(iptables -L INPUT -v -n | grep $line) ]]; then
      iptables -A INPUT -s $line -j DROP
      echo "Blocking: '$line'"
      counter=$((counter + 1));
    fi
  done < <(cat $1)
  
  echo
  echo "Saving Changes"
  echo
  
  iptables-save
  
  echo
  echo "IP Newly Banned: $counter"

  [close]
• Save & Close the file
• Make the file executable: $ chmod 700 banIPs.sh
• Start the script and have all the IPs banned: $ ./banIPs.sh ips.list

I'm sorry I do not have any script for Windows as I'm not doing that kind of technical stuff on such system.
Feel free to post one if you have !

Feel free to reply to the topic or shoot a PM if you need help.

[QuBeZ]

As a side note I want to point out the effectiveness that Beyond Servers have shown throughout this unfortunate attack. I also want to advertise Beyond Servers and Dodo, thanks to the fast response in putting up a script in such a fast time and therefore preventing any further attacks.

[Dealen]

Who is behind these attacks?

[Michael Sparks]

Who is behind these attacks?

ngl its probably someone really autistic or salty like betty

but if you're a smart dodo, not a silly goose it's easy to get around as sendodopai has mentioned here

if u talk shit i will swat u tho kid

[Dodo]

As a side note I want to point out the effectiveness that Beyond Servers have shown throughout this unfortunate attack. I also want to advertise Beyond Servers and Dodo, thanks to the fast response in putting up a script in such a fast time and therefore preventing any further attacks.

Thank you very much for your kind words QuBeZ.

Who is behind these attacks?

It is yet unknown. Nobody has claimed such attack (unless Betty but he has often been claiming things he wasn't involved in), and we probably will never know.
IPs used for such attacks are just relays reserved for malicious stuff, which make them untracable without the help of the host (who did not appear cooperative).

ngl its probably someone really autistic or salty like betty

but if you're a smart dodo, not a silly goose it's easy to get around as sendodopai has mentioned here

if u talk shit i will swat u tho kid

I'm really sorry, I'm having a hard time understanding you.

[Michael Sparks]

ngl its probably someone really autistic or salty like betty

but if you're a smart dodo, not a silly goose it's easy to get around as sendodopai has mentioned here

if u talk shit i will swat u tho kid

I'm really sorry, I'm having a hard time understanding you.

thats the idea

[NickyJ]

ngl its probably someone really autistic or salty like betty

but if you're a smart dodo, not a silly goose it's easy to get around as sendodopai has mentioned here

if u talk shit i will swat u tho kid

I'm really sorry, I'm having a hard time understanding you.

Translation:

ngl its probably someone really autistic or salty like betty

but if you're a smart like dodo, not a silly goose, it's easy to get around as sendodopai dodo has mentioned here

if u talk shit i will swat u tho kid I'm from the hood, yo

[Michael Sparks]

ngl its probably someone really autistic or salty like betty

but if you're a smart dodo, not a silly goose it's easy to get around as sendodopai has mentioned here

if u talk shit i will swat u tho kid

I'm really sorry, I'm having a hard time understanding you.

Translation:

ngl its probably someone really autistic or salty like betty

but if you're a smart like dodo, not a silly goose, it's easy to get around as sendodopai dodo has mentioned here

if u talk shit i will swat u tho kid I'm from the hood, yo

yes this pleases me

[Ambiguous]

ngl its probably someone really autistic or salty like betty

but if you're a smart dodo, not a silly goose it's easy to get around as sendodopai has mentioned here

if u talk shit i will swat u tho kid

I'm really sorry, I'm having a hard time understanding you.

Translation:

ngl its probably someone really autistic or salty like betty

but if you're a smart like dodo, not a silly goose, it's easy to get around as sendodopai dodo has mentioned here

if u talk shit i will swat u tho kid I'm from the hood, yo

yes this pleases me

hail admiral_poo

[Michael Sparks]

ngl its probably someone really autistic or salty like betty

but if you're a smart dodo, not a silly goose it's easy to get around as sendodopai has mentioned here

if u talk shit i will swat u tho kid

I'm really sorry, I'm having a hard time understanding you.

Translation:

ngl its probably someone really autistic or salty like betty

but if you're a smart like dodo, not a silly goose, it's easy to get around as sendodopai dodo has mentioned here

if u talk shit i will swat u tho kid I'm from the hood, yo

yes this pleases me

hail admiral_poo

sieg heil

[OttoFIN]

Error Code 666 - Please insert Betty to continue.

[Gishank]

As most denial-of-service attack methods obfuscate the origins of the attack, and even falsify the packet's IP origins, is posting a list such a wise idea? Given you're essentially encouraging people to ban random addresses which may of actually had no direct participation in the address, which could be harmful in the long-run should the IP ever be assigned to an end-user.

[Dodo]

As most denial-of-service attack methods obfuscate the origins of the attack, and even falsify the packet's IP origins, is posting a list such a wise idea? Given you're essentially encouraging people to ban random addresses which may of actually had no direct participation in the address, which could be harmful in the long-run should the IP ever be assigned to an end-user.

Are you telling me banning those IPs wasn't the right solution ?
As mentioned above, twp of Beyond Servers' customers were under attack and suffered high ping.
All those IPs, each single one of them were detected as attacker, are you telling me I should have left them attacking instead of blocking them ?

Even though those IPs might get assigned to legit users in the future, they currently represent a threat and must be dealt accordingly.
But you're right, those IPs might be re-assigned in the long run, but I prefer having two or three legit users asking for unban rather having customers with servers lagging as hell.

I give out the IPs for people that do not know how to defend themselve, or even you Gishank, if you ever get attacked by someone linked, having those IPs could save you a lot of time and a few events as they literally can attack anyone as DDoS protections are powerless against it. But yeah, as mentioned in OP, you can do whatever you want with those IPs, just posted it in the optoc of helping the community defending itself against attacks.

[notmoving]

59th lads are suffering the same currently.

Also i have total trust in dodo to do whats is right to protect his servers as he always does. If there are any innocents caught up in it (I highly doubt there are any (Betty ban list for example) He will deal with it as i'm sure he will spend his time checking out each IP to see if they are genuine or not.

[Tim]

My servers (NRP, JB and various 59th servers) all suffered from the same attack, thank you Dodo for posting this, appreciate it.

I use windows server 2012 and found a nice way to add the IPs to the windows firewall with this method.
http://cyber-defense.sans.org/blog/2011/10/25/windows-firewall-script-block-addresses-network-ranges

If you need some help with this message me on steam [59th] Tim and I will see if I can help you as I had some problems getting it running myself.

Cheers Dodo.