All client sites have been moved to new IP addresses and only a few of my old websites remain on the old IP address. I received a message at about 11pm from my system admin who suggested that the attack is over and that he had removed the IP block from the afflicted IP address. With in 15 minutes I had another message from him explaining that the attack started back up. Of course this is a bummer but it is great confirmation that the efforts I put in place to fix the problem for all of my clients worked.
I have also been told by several of the system administrators I have communicated with that they have never seen an attack so persistant. Usually DDos attacks last a short while and when they go away they almost never come back.
I am just glad I have everything set up the way I do. If I did not have a team watching over my server 24/7/365, I would not have caught this so early and been able to take action to get my clients sites back up in less than 12 hours.
