[nsp-sec] DDoS aimed at 178.251.233.35

[Saunders, D'Wayne S]

>
>ACK1221
>
>Source look to be spoofed as I can't see any flows relating to these IP's
>We did have a few packets originating from another IP to that destination
>but the traffic was very minimal over a 30 minute period. No longer any
>traffic from AS1221 is going to that IP that I can determine ( sampled 1
>in 5000 )
>
>1221 | 203.46.105.34 | 32000
>1221 | 203.46.105.41 | 16000
>1221 | 203.46.105.43 | 62000
>1221 | 203.46.105.59 | 90000
>
>
>