An update on your LET Special M10G Storage 1TB on le4-0-72invictus: it is still unreachable from the internet. It has been down since about 18:55 UTC on 26 September. The provider drops the attack traffic before it reaches our network, so the attack does not touch the servers themselves or your files.
Since our last email, we have learned why the block is still on.
The attack is big enough that it hurt our upstream network provider's own backbone, not only our address range. Their routers came under heavy load, and a Finnish household TV provider on the same network saw its customers' TV pictures break up badly. To protect everyone else on their network, the provider blocked traffic to our affected address range again. That TV provider is a much larger customer of theirs than we are, both in revenue and in the number of people it serves, so it is understandable that their service comes first.
About the attack: it is a flood of fragmented UDP traffic aimed at high port numbers. It comes from many networks in many countries. In the provider's sample the largest single share, about 15%, came from Russia. That spread looks like a botnet rented out as a service. Attacks like this are surprisingly cheap to buy, so there is no way to know how long this one will be kept up. While the block is on, it is not possible to know whether the attack is still going.
What is being done: we are in direct contact with the provider, and they are investigating the attack and the routes it arrives on. Once the block is lifted, routing changes take some time to spread across the internet, so access may come back gradually rather than all at once.
What you need to do: nothing. If you have questions, open a support ticket in the client area.
We are sorry for the trouble this is causing.
Warmly,
Väinämöinen
Pulsed Media Support
译文
您好 Aas，
关于您位于 le4-0-72invictus 节点上的 LET Special M10G Storage 1TB 服务，现向您通报最新情况：该服务目前仍无法从互联网访问。自 9 月 26 日 UTC 时间约 18:55 起，服务便处于中断状态。服务商会在攻击流量到达我们网络之前将其拦截，因此攻击并未波及服务器本身或您的文件。
自上次邮件沟通以来，我们已获悉封锁措施为何仍在持续。
此次攻击规模巨大，不仅影响了我们的 IP 地址段，还波及了上游网络服务商的主干网络。他们的路由器承受了沉重负载，导致同一网络下的一家芬兰家庭电视服务商出现了严重的电视画面卡顿或花屏现象。为了保护网络中的其他用户，服务商再次封锁了针对我们受影响地址段的流量。相比我们，该电视服务商无论在营收贡献还是服务用户数量上，都是对方更重要的客户，因此优先保障其服务是合乎情理的。
