[nsp-sec] UDP flood against 83.218.20.202 - assistance tracking C&C & hackanonymous

[Matthew.Swaar at us-cert.gov]

Steve,

FWIW, based on the backscatter that I see from 83.218.20.202 (SYN-ACKS from source port TCP-80) some/all of the syn-flooding that you're seeing is spoofed.  I don't know how that volume compares to the UDP traffic you're seeing.

Very Respectfully,

US-CERT Ops Center
888-282-0870
POC: Matt Swaar - Analyst