Someone ddos through Google servers

hien

Today, one of my clients got ddos'd. But all of ddos IP is from Google Network, over 2k different IPs. Example log you can view here: http://pastebin.com/raw.php?i=1WLLE4bu. I think I will block this user agent as temporary solution :(

Related link: http://www.ihteam.net/advisory/make-requests-through-google-servers-ddos/

Why Google still not fix ?

yomero

Are you sure the traffic is incoming? Because probably is some kind of UDP spoofing.

Edit: I've read the log... lol Doesn't seems the same kind of attack...

hien

This log is from nginx's access log. TCP! no UDP!

yomero

Yes, I edited my answer, that's why...

Have you read this, from your linked article?

http://www.behind-the-enemy-lines.com/2012/04/google-attack-how-i-self-attacked.html

Damian

@yomero said: http://www.behind-the-enemy-lines.com/2012/04/google-attack-how-i-self-attacked.html

One of our clients has this going on. He's not willing to fix the problem, so just waiting for his monthly bandwidth allocation to get exhausted.

hien

@yomero said: Yes, I edited my answer, that's why...

Have you read this, from your linked article?

http://www.behind-the-enemy-lines.com/2012/04/google-attack-how-i-self-attacked.html

I've already read that link :(

eastonch

That's not a DDOS... That's pretty badass that google's doing that.. Maybe they should start having some form of protection from spamming that.. LOL!

Soylent

This is Google's new business idea, since AdSense revenues are dropping.

"That sure is a nice website you have there. It'd be a shame if something happened to it..."

hien

Today, i recieved a reply mail from Google Security ask for my IP server to investigate this issue.

Victor

@hien said: Today, i recieved a reply mail from Google Security ask for my IP server to investigate this issue.

Interesting, keep us updated. :)