Kevin Karhan :verified:<p><span class="h-card" translate="no"><a href="https://infosec.exchange/@varbin" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>varbin</span></a></span> <span class="h-card" translate="no"><a href="https://chaos.social/@f4grx" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>f4grx</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.social/@nixCraft" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>nixCraft</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.social/@torproject" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>torproject</span></a></span> Well, you can dynamically block them based off packet rate & amount of requests and rate-limit them as well as limit them in terms of transfer rate.</p><ul><li>Also <a href="https://infosec.space/tags/DDoS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DDoS</span></a>-Protection is something any decent <a href="https://infosec.space/tags/datacenter" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>datacenter</span></a> & <a href="https://infosec.space/tags/hoster" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>hoster</span></a> offers (don't use value-removing middlemen like <a href="https://infosec.space/tags/CloudFlare" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CloudFlare</span></a> as they are a <a href="https://infosec.space/tags/RogueISP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>RogueISP</span></a> <a href="https://www.youtube.com/watch?v=Hi5sd3WEh0c" rel="nofollow noopener noreferrer" target="_blank">who ain't even goox at their job!</a>)</li></ul><p>Not to mention you <em>rarely</em> see DDoS attacks from residential IPs and ISPs are quick to disconnect offending hosts upon reporting them, so worst-case one blocks a /24 for 24 hours.</p><ul><li>This doesn't even account for the fact that <a href="https://infosec.space/tags/Skiddie" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Skiddie</span></a>-Tools like <a href="https://infosec.space/tags/LOIC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>LOIC</span></a> are easily dstinguishable and filter for.</li></ul><p>Again: if this is a real problem, any decent datacenter / hoster / upstream will gladly pick up the phone or reply to your support request via mail.</p><ul><li>After all, they too don't like it when someone hammers their infrastructure, so they have a vested interest in <a href="https://infosec.space/tags/Blackholing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Blackholing</span></a> bad traffic at the <a href="https://infosec.space/tags/IX" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>IX</span></a> level.</li></ul><p><a href="https://infosec.space/tags/DECIX" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DECIX</span></a> even officially recommends that as a means to handle large-scale DDoS attacks and keep everyone else online.</p><ul><li>To me a <em>"<a href="https://infosec.space/tags/Layer7" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Layer7</span></a>"</em> solution like <a href="https://infosec.space/tags/Anubis" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Anubis</span></a> comes way too late as it already incurs <em>billable traffic</em> at many hosters and datacenters and we don't want to cough up money because of someone else trying to <a href="https://infosec.space/tags/blackmail" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>blackmail</span></a> us (which is the #1 reason for DDoS'ers to do so!)…</li></ul>