This question already has an answer here:
- I am under DDoS. What can I do? 4 answers
I just received an email from my website internet provider that my server has been "involved as open resolvers in DDoS attacks (DNS Reflection) over the past few weeks."
Here is the full email:
Subject: DNS amplification attack Dear Sir or Madam,
We have received spam/abuse notification. Please take the necessary steps to prevent this from happening again in future.
Furthermore, we would request that you provide both ourselves and the person who has submitted this complaint with a short statement within 24 hours. This tatement should include details of the events leading up to the incident and the steps you are taking to deal with it.
Next steps: - Solve the problem - Send your statement to us - Send your statement to the person making the complaint per email
The details will then be checked by a colleague, who will coordinate further proceedings. In the event of several complaints, this may lead to the server being locked. ----- attachment -----
Dear Sir or Madam,
We have been informed that IP addresses from your network range have been involved as open resolvers in DDoS attacks (DNS Reflection) over the past few weeks.
Please see the attachment to this message for the IP addresses of the open DNS servers in your network range.
----- log file -----
Affected IP: 220.127.116.11
What can I do to confirm this and to identify the origin of this attack?