KDDI

The site that attacked Doc last night was associated with a anti-peer to peer who owns a cloud at KDDI. The unsuspecting product that brought on the attack was the KM Player, a Korean Multimedia player.

Victim IP information removed-Actual data 12/25/2011 Time is GMT-7

On the start of the Multimedia player, a website in the 61.111.0.0/8 range pops up and begins a low level stream to a Korean site known as Pandora T.V. It is believed that Pandora streams the data to its site and either copy's its stream to a drive for later use or streams it across the web to homes for a fee.

Next come 209.137.130.253 with powerful chats trying to block the out going signal. When that fails, the KDDI cloud smothers the victim by over powering him with a TCP DDoS what doc calls a "superfly" attack, similar to a Brute Force attack.

This attack damaged a network switch and recording software known as a "real time log viewer" associated with the firewall, used to video capture the event. Attorneys picked up the Capture today to be used in the up coming trial.

Doc, smarter than the average bear, lured the attacker again today so NAIDI (North American Internet Defense Initiative) back trace the IP address for the NAIDI's attorney.

The back trace was successful.

This will be known as the Christmas Eve attack.