Thanks to our reader David for sending us this detect (anonymized):
GET announce?info_hash=....peer_id=....ip=....port=....uploaded=....downloaded=....*left=....numwant=.... HTTP/1.0
Host: a.tracker.thepriatebay.org
User-Agent: Bittorrent
Accept: */*
Connection: closed
Davids web server was hit with a sufficient number of requests like the one above to cause a denial of service. The requests originated from thousands of different IP addresses, all appear to be located in China. A quick Google search revealed that he wasnt alone, but other web servers experienced similar attacks.
Given the host header (and David observed various thepriatebay.org host names), it looks like some DNS servers responded with Davids IP address if queried for thepiratebay.org.
I did a quick check of passive DNS systems, and didnt find Davids IP. But when I queried Chinese DNS servers for the host name, I recieved numerous answers. Each answer was only repeated a couple times, if at all. It sort of looked like they all returned different IP addresses. US based DNS servers on the other hand usually dont resolve the host name, or respond with 127.0.0.1, a typical blacklisting technique. Only a handful responded with a routable IP address.
Overall, I am not sure what is happening. Looks like a Chinese firewall issue to me. But if you have any ideas or packets, please let me know.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.