Level3/GC: IMMEDIATE: Trace request on TCP SYN attack traffic towards


(my work hat @ CERT-FI on, work email kauto.huopio@ficora.fi)

Several Finnish media sites (www.yle.fi, www.mtv3.fi, www.hs.fi etc)
have been attacked since Dec 25th.

Current target is www.ampparit.com ( ISP reports
traffic originating from Level3 transit. Traffic is > 2 Mpps TCP SYN.

I'd like to request immediate trace support - we suspect this is a
very small source
footprint DOS. All observations to cert@ficora.fi, cc: to me at work
address above.