Hallo,
zur Zeit wird gegen meinen kleinen Mailserver und meine HP massive DDOS Angriffe gefahren.
Ich hatte Kontakt mit dem Netzbetreiber der vermeintlichen SRC IP aufgenommen. Dessen Antwort mal hier als Kopie :
Hello. It looks like us but it is not. Your network is used as reflection to DDoS our network because your IP is accepting/relying IP packets witch hold a /32 source IPs from other networks (in this case an IP from our ASN). Some attacker is sending TCP SYN to your IP subnets with our IP subnets in the packet. Probably to normal ports like 443, 80 etc. Therefore your IP application replies with a ACK to our network. If you look closer to the carrier who sent the request to you, you probably can see in your firewall which ASN number is sending the request to you. If you know, please let us know the ASN and IP, because it could help us finding the network which sending the DDoS.
Kann mir jemand hier weiter helfen ? Danke.
This thread was automatically locked due to age.
