Monday, March 2, 2026

[Incident Report #027][DNS] Name Server Attack

What Happened?
From around 0000 to 0400EST last night, our name servers were
hit with a large amount of traffic originating from a data center
in the Netherlands. The traffic was spread across multiple IPv6
subnets and volume was high enough the it saturated the virtual
bridges that our name servers are operating behind. This is the
third attack of this kind that our network seen in the past two weeks.

What damages Resulted?
During the attack, we saw the following issues:

  • Accounting service lost contact with both NS1 and NS2
  • Shell access was slow or non-responsive
  • Legitimate name lookups were being dropped or timed out
  • The NMS lost SNMP contact entirely with NS1
  • High CPU load on Nardoragon router

What are we doing to deal with this?
Going forward, the following steps will be taken to try and maintain
the usability of our name servers during similar attacks:

  • Deploy a separate virtual bridge and network interface for management
  • Tightening per subnet rate limits and mask sizing
  • Banning AS numbers that partake in attacks like this
  • Increasing virtual bridge bandwidth to allow for more throughput
  • Redirecting recurring problematic subnets and AS ranges to null

Monday, February 23, 2026

Influx of DNS Traffic

It appears that overnight, our name servers experienced levels of traffic that
our network has not seen before. The request rate reached up to 800+ request
per second incoming and our internal tooling failed to send emails or alert us
via Discord that anything had happened.

It looks like a bunch of VPS instances from a provider over in the Netherlands
started performing mass lookups for a crypto exchange and this traffic was
sustained for quite a while during the night, as our network graphs are showing
and that our 500MB log file limit on both name servers was exhausted.

Our team will be looking into our rate limit configurations and possibly
re-configuring the IDS on our routers to be a little more proactive on alerting
us to conditions like what happened last night.

Sunday, February 22, 2026

Releasing Domains and Ongoing Amplification Attacks

FurrIX has chosen not to renew the domains ‘birb.rest’ and ‘avali.rest’ for cost reasons.
These domains are not a core part of our network stack and were only used for personal
splash pages and a handful of user subdomains that have not seen lookups in some time.
This should not affect our operations, or that our members, in any meaningful way.

We are also dealing with a DNS amplification attack that is abusing ANY queries and will be
temporarily dropping any IP address that cross over 40 request per second until the incoming
traffic targeting the domains starts to ease up. This has been going on for several hours and
we are working to limit the amount of traffic crossing or originating from our network.