RE: Comcast / Xfinity CyberSecure blocking DDoS-victim IPs - seeking a contact

["Brotman, Alex via NANOG" <nanog () lists nanog org>]

Hello,

I've given this message to the team that handles those inquiries.  Hopefully, they have enough information below to 
escalate/resolve properly.

-- 
Alex Brotman
Sr. Engineer, Anti-Abuse & Messaging Policy
Comcast
 

> -----Original Message-----
> From: SurgeNode via NANOG <nanog () lists nanog org>
> Sent: Wednesday, October 21, 2026 3:52 PM
> To: nanog () lists nanog org
> Cc: SurgeNode <mail () surgenode net>
> Subject: Comcast / Xfinity CyberSecure blocking DDoS-victim IPs - seeking a
> contact
>
> ​Hi all,
>
> I'm looking for someone at Comcast who works on the Xfinity CyberSecure
> (formerly xFi Advanced Security) IP reputation list, or who can route this to the
> right team.
>
> We run SurgeNode, a small game-server host. CyberSecure is blocking two of our
> IPs (announced by our upstream, AME Hosting / bloom.host, AS399244) for Xfinity
> subscribers:
>
> 170.205.24.84 (va4.surgenode.net)
> 170.205.24.153
>
> The block is on the IP itself, so the spa.xfinity.com form (which only accepts URLs)
> comes back as "no block found", and the CSA phone team refers customers back
> to us as the host.
>
> We believe the IPs were flagged because of spoofed-source traffic during DDoS
> attacks against a game server we host, not traffic originating from it:
>
> - AbuseIPDB reports for .84 (Sep 12-17) show SYNs "from" our IP to tcp/30120
> with TTLs ranging 36-57 and widely varying window sizes within minutes of each
> other
> - The remaining reports are "port scans" and MySQL/SSH probes from our IP to
> third-party hosts, which matches SYN-ACK reflection: spoofed SYNs sent in our
> name so the replies flood us
> - Other reports show backscatter from our tcp/30120 to random high ports
> - The most recent report (Oct 18) is a DNS flood, consistent with a DNS reflection
> attack against us
> - 170.205.24.153 has no AbuseIPDB reports at all, so its block may be range-
> based or come from a different feed
>
> We've requested takedown of the AbuseIPDB reports and are happy to share
> packet captures and traffic logs off-list. Several hundred of our players on Xfinity
> currently can't connect, so any pointer to the right contact would be much
> appreciated.
>
> Thanks,
> Director, SurgeNode Ltd
> mail () surgenode net
> _______________________________________________
> NANOG mailing list
> https://urldefense.com/v3/__https://lists.nanog.org/archives/list/nanog@lists.n
> anog.org/message/VD3S666UCKCG3LIEGHEFHRN23DVR6FPL/__;!!CQl3mcHX2A!
> GNulY6PTU1c6b7DfQ8tyyFztakyt6upqU55_66g1pTUXjtxnJgs29lcNRcAw4ca6dHV
> uUWUp_QP_aPUlsj4SQA$
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/WL2VCM4C42ZKSQGVVNMKAJG7UP3FNPM7/