Daryl C. W. O’Shea: Lazy Network Engineer » URIBL, SURBL and Spamhaus suffer SYN floods

In case you ever needed evidence that URI blacklists are effective or that spammers don’t like Spamhaus, you’ve now got a DDoS SYN flood attack to back up that argument. The web mirrors for the three sites have been down for most of the day due to what’s reported by URIBL as “heavy syn floods for anyone operating a web mirror for uribl, surbl, or spamhaus”. The SpamAssassin Rules Emporium (SARE) website is also down. It is hosted on one of the URIBL mirrors. As of tonight, Spamhaus’ website is back up and running on a new IP. I’m really surprised that this didn’t happen a lot sooner.