Comcast / Xfinity CyberSecure blocking DDoS-victim IPs - seeking a contact

[SurgeNode via NANOG <nanog () lists nanog org>]

​Hi all,

I'm looking for someone at Comcast who works on the Xfinity CyberSecure (formerly xFi Advanced Security) IP reputation 
list, or who can route this to the right team.

We run SurgeNode, a small game-server host. CyberSecure is blocking two of our IPs (announced by our upstream, AME 
Hosting / bloom.host, AS399244) for Xfinity subscribers:

170.205.24.84 (va4.surgenode.net)
170.205.24.153

The block is on the IP itself, so the spa.xfinity.com form (which only accepts URLs) comes back as "no block found", 
and the CSA phone team refers customers back to us as the host.

We believe the IPs were flagged because of spoofed-source traffic during DDoS attacks against a game server we host, 
not traffic originating from it:

- AbuseIPDB reports for .84 (Sep 12-17) show SYNs "from" our IP to tcp/30120 with TTLs ranging 36-57 and widely varying 
window sizes within minutes of each other
- The remaining reports are "port scans" and MySQL/SSH probes from our IP to third-party hosts, which matches SYN-ACK 
reflection: spoofed SYNs sent in our name so the replies flood us
- Other reports show backscatter from our tcp/30120 to random high ports
- The most recent report (Oct 18) is a DNS flood, consistent with a DNS reflection attack against us
- 170.205.24.153 has no AbuseIPDB reports at all, so its block may be range-based or come from a different feed

We've requested takedown of the AbuseIPDB reports and are happy to share packet captures and traffic logs off-list. 
Several hundred of our players on Xfinity currently can't connect, so any pointer to the right contact would be much 
appreciated.

Thanks,
Director, SurgeNode Ltd
mail () surgenode net
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/VD3S666UCKCG3LIEGHEFHRN23DVR6FPL/