Cloudflare write in a recent attack:
The top networks included the German provider Hetzner Online GmbH (Autonomous System Number 24940), Azteca Comunicaciones Colombia (ASN 262186), OVH in France (ASN 16276), as well as other cloud providers.
A wise network operator once told me - never shit on people when they are under attack. Because in the not too distant future you are going to be the victim.
I assume this attack is UDP based unlike the one you linked too.
They aren't even in the top 10 here. Its the claim hetzner is larger than AWS? I find that highly unlikely.
Likely the attack isn't an overwhelming volumetric attack as I assume they have some fat pipes and big routers, but there's likely a bottleneck somewhere in their network.
- You need to identify the traffic to be filtered and the post states: "Due to always different destinations (IPs, ports, packet size) (..)"
- You need to maintain some agreement with a large number of ISPs
- You need to maintain some gossiping infrastructure to these ISPs
- ISPs may not care about your DDoS attack
As a participant you can avoid paying to send outbound attack traffic, and also identify attack sources within your own network.
Does anybody know what usually runs on those ports?
Hetzner is a popular host for game servers.
seriously, aren't they commonly the SOURCE of many DoS attacks...
any hosting provider where some random person on the internet and $5 of credit on a prepaid visa card will have this problem.
