Loading story…
Network operators on the NANOG mailing list said remotely triggered black hole (RTBH) routing remains widely used for DDoS response but is implemented inconsistently across providers, with limited documentation and no universal cross-network model. James Bensley launched surveys and a public repository to collect details on how RTBH is deployed, why operators choose it, and what security and observability tradeoffs they face, with the stated aim of informing operational guidance, a BCOP, or a possible RFC on filtering practices.
Participants said RTBH can be attractive because it is simple and can quickly protect other customers by dropping traffic to an attacked destination, especially for smaller operators, but critics warned that full blackholing reduces visibility and may prolong outages by making it harder to tell when an attack has ended. Operators discussed alternatives such as downgrading attack traffic into a scavenger QoS class to preserve observability and automate recovery, while also noting that BGP FlowSpec is not yet a practical industry-wide replacement because of uneven vendor support, rule-compression differences, TCAM limits, and limited acceptance by upstreams, peers, and IXPs; broader anti-spoofing measures such as uRPF were also highlighted as important for spoofed-traffic attacks.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
In the NANOG discussion, James Bensley says he launched a survey and a public repository to collect details on how remotely triggered black hole routing is implemented across networks. He also describes conducting a second survey on operator motivations, concerns, observability, and security considerations around RTBH.
See what this changes for your reporting obligations and which controls it puts on the clock.
23 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourcedocs.google.com
Open sourceremotely-triggered-black-hole.github.io
Open sourcelists.nanog.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NANOG mailing list participants sought an accurate list of IP ranges tied to **Cloud Innovation** after operators reported attack traffic from Seychelles-associated networks that were now receiving transit through **Cox Communications** (`AS22773`). David Hubbard said the routing change complicated mitigation because blocking Cox would also affect substantial legitimate traffic, turning what had been a more targeted filtering problem into a broader operational risk. The discussion also highlighted that many of the same networks appeared to be routed by **AS35916** (identified in the thread as **Multacom**), with more specific advertisements seen via Cox, raising questions about whether Cloud Innovation and Multacom are the same entity or have a business relationship. In reply, Frank Habicht shared **AFRINIC** delegation data associated with identifier `F368F2D0` and provided four large IPv4 CIDR blocks, while cautioning that any use of the list for blocking should be done at the operator's own risk.
Jun 29, 2026
Akamai reported the first observed in-the-wild **DDoS attacks** using **TCP Middlebox Reflection**, a technique that abuses vulnerable firewalls, deep packet inspection devices, content-filtering systems, and censorship-related middleboxes to reflect and amplify traffic toward victims. The activity marked the practical weaponization of an attack path that had previously been discussed largely as a theoretical risk, with campaigns beginning around February 17 and hitting organizations in banking, travel, gaming, media, and web hosting. In one case, a single TCP `SYN` packet with a 33-byte payload triggered a 2,156-byte response, producing roughly **65x amplification** and lowering the bandwidth attackers need for volumetric attacks. Akamai observed attack traffic peaking at **11 Gbps** and **1.5 million packets per second**, underscoring that amplification threats are no longer limited to the better-known **UDP-based reflection** methods tracked by defenders and government agencies, and that mitigation strategies must now account for abuse of TCP-handling middleboxes as well.
Aug 14, 2026
GreyNoise reported a sudden, sustained **step-function collapse in global Telnet traffic** beginning around **21:00 UTC on 2026-01-14**, dropping from roughly **65k–74k hourly sessions** to about **11k within two hours** (an ~**83%** decline) and then holding at a lower baseline. GreyNoise assessed the change as a structural shift in Internet “plumbing” (not normal scanner churn or a telemetry issue) and noted the drop preceded public disclosure of **CVE-2026-24061** (posted to oss-security on 2026-01-20) and CISA’s subsequent addition of the CVE to the **Known Exploited Vulnerabilities (KEV)** catalog (by 2026-01-26), suggesting the traffic collapse and exploitation activity may be related. Despite the global reduction, Asia-Pacific networks showed comparatively weaker suppression of Telnet, leaving continued exposure from insecure, legacy Telnet services on devices such as consumer-grade routers. GreyNoise data cited by Dark Reading indicated inconsistent national-level filtering in the region—**Taiwan** blocked ~**77%** of Telnet sessions (the strongest in the region), while **India** (~70%), **Japan** (~65%), and **China** (~59%) reduced traffic less aggressively—contrasting with countries such as **Ukraine** and **Canada** that reportedly blocked Telnet traffic entirely. The net effect is that while backbone-level controls appear to have materially reduced global Telnet scanning and session volume, organizations operating in lagging jurisdictions may still face elevated risk from Telnet-exposed assets and exploitation tied to **CVE-2026-24061**.
Jun 29, 2026