Dear Sirs,

This is an automatic message that will not be sent anymore when the event below ceases. We detected an attack to our network that come from an IP owned by your ASN. The IP off your network 209.124.33.137 was infected and are sending attack to our network (189.1.169.243). Follow below our logs that you can take proper actions. If you do not found the application that is generating this traffic, you can block this using iptables. You can do this using the follow command line: iptables -A OUTPUT -d 189.1.160.0/255.255.240.0 -j DROP


=====================================================================================

01:48:44.031318 IP 207.97.241.170.27660 > 189.1.169.243.28927: UDP, length 15
01:48:44.031559 IP 207.97.241.170.27660 > 189.1.169.243.28904: UDP, length 15
01:48:44.031923 IP 207.97.241.170.27660 > 189.1.169.243.28904: UDP, length 15
01:48:44.036411 IP 207.97.241.170.27660 > 189.1.169.243.28904: UDP, length 15
01:48:44.043743 IP 207.97.241.170.27660 > 189.1.172.238.28965: UDP, length 15
01:48:44.046053 IP 207.97.241.170.27660 > 189.1.169.243.28923: UDP, length 15
01:48:44.052779 IP 207.97.241.170.27660 > 189.1.169.243.28907: UDP, length 15
01:48:44.052871 IP 207.97.241.170.27660 > 189.1.169.243.28907: UDP, length 15
01:48:44.058127 IP 207.97.241.170.27660 > 189.1.169.243.28907: UDP, length 15
01:48:44.063446 IP 207.97.241.170.27660 >