<body><div id="__MailbirdStyleContent" style="font-size: 10pt;font-family: Arial;color: #000000">
The problem is that they are spoofing our IP, to millions of IP's running port 80.<div>Making upstream providers filter it is quite difficult, i don't know all the upstream providers are used. </div><div><br></div><div>The main problem is honestly services that reports SYN_RECV as Port Flood, but there isn't much one can do about misconfigured firewalls.I am sure there is a decent amount of honeypots on the internet acting the same way, resulting us (the victims of the attack) getting blacklisted for 'sending' attacks.</div><div class="mb_sig"></div><blockquote class="history_container" type="cite" style="border-left-style:solid;border-width:1px; margin-top:20px; margin-left:0px;padding-left:10px;">
<p style="color: #AAAAAA; margin-top: 10px;">On 28.01.2020 05:50:14, "Dobbins, Roland" <roland.dobbins@netscout.com> wrote:</p><div style="font-family:Arial,Helvetica,sans-serif">
<div dir="ltr"><br>
</div>
<div dir="ltr"><br>
<blockquote type="cite">On Jan 28, 2020, at 11:40, Dobbins, Roland <Roland.Dobbins@netscout.com> wrote:<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr">And even if his network weren't on the receiving end of a reflection/amplification attack, OP could still see backscatter, as Jared indicated. </div>
</blockquote>
<br>
<div>In point of fact, if the traffic was low-volume, this might in fact be what he was seeing. </div>
<div><br>
</div>
<div>
<p class="p1" style="margin: 0px;font-stretch: normal;font-size: 17.4px;line-height: normal;color: rgb(69, 69, 69);-webkit-text-size-adjust: auto">
<span class="s1" style="font-size: 17.41pt">--------------------------------------------</span></p>
<p class="p1" style="margin: 0px;font-stretch: normal;font-size: 17.4px;line-height: normal;color: rgb(69, 69, 69);-webkit-text-size-adjust: auto">
<span class="s1" style="font-size: 17.41pt">Roland Dobbins <roland.dobbins@netscout.com></span></p>
</div>
</div></blockquote>
</div></body>