madact

Reflected traffic TTL inherits from amplifier. Direct spoofed uses attacker OS default. 50 Gbps last Tuesday, scrubbing center saw identical SYN patterns. TTL 64 vs 117 split the difference. Filtering layer 4, no anycast involved.

This. Absolutely this. I went through something similar with Afternic a couple years back, not identical but the same smell. They wanted a "reactivation fee" for a sale that fell through because the buyer's wire bounced. I refused and eventually they j...

Following.