Large scale DDoS attacks and simulated DDoS tests against VoIP providers

At the time of writing , A group called VoIP.ms The main VoIP Provider is experiencing a distributed denial of service (DDoS) Since the attack for more than a week . result , They can't serve their customers , Everyone and their dogs complain that they can't connect to VoIP.ms Of SIP Servers and other resources . meanwhile , Some people claim to be REvil A member of the ransomware organization , Blackmailing suppliers .

This is not an isolated case , Because earlier this month , Some British suppliers have also been attacked , The report also mentions REvil Is the source of the attack . Many people from the safe community think it is unlikely to be true REvil, But this is not what I want to write here .

We did contact the person of one of the attacked British suppliers , He explained that the , In their sampling of attack traffic , They didn't see anything SIP Data packets . contrary , What they do see is DNS、SNMP And others usually appear in amplification attacks and botnets DDoS Traffic in attack .

Not just about SIP Denial of service

By reading about these DDoS Public reports of attacks , Obviously , The victimized company is not only in its SIP Suffer at the end . It is mentioned that a large amount of traffic indicates that the attack may be of capacity , Not application specific .

stay VoIP.ms Under the circumstances , They originally had a DNS interrupt , Then turn to using Cloudflare As their DNS. They also put their website on Cloudflare Website DDoS After protection , And start asking for verification code, etc .

They also moved POP（ Access point ）SIP Server's IP Address , And you can see people complaining on the forum SIP The connection fails . lately , People noticed that they were passing Cloudflare Of Magic Transit Route their SIP Traffic , The Magic Transit Provide UDP DDoS Protect .

However , They still seem to have intermittent connections , Or sometimes it seems to be offline .