Syn flood to TCP port 21 from priveleged port (80)

Tue Nov 1 23:59:24 UTC 2016

Most of those networks are served by Prolexic DDOS mitigation (AS 32787),
and according to BGPlay have been for a while. (AS carrying untoward material,
like a Tor exit node or onion router?)

But a couple /24s in the 95.* block are AS14537 Mohawk Internet Tech.  in
Quebec Canada such as 95.131.188.0/24 - unintended target? (careful who you
buy /24's from!)

So the only target being affected would be Mohawk unless they're setup to handle it.

/kc
--
Ken Chase - math at sizone.org Guelph Canada