I am receiving constant traffic from an IP. I have checked web server logs and found nothing. I have used IP tables to close port 80 with no success.
Here is what I have extracted:
TCPDump after closing port 80:
...
16:29:58.352491 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 2165011454, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:29:58.354140 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 1721916742, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:29:58.437774 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 363447977, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:29:58.524299 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 137986954, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:29:58.610422 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 1651557377, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:29:58.695648 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 1644752218, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:29:58.762889 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 708774106, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:29:58.781295 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 1366521335, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:29:58.821036 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 1828494182, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:29:58.866077 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 858654160, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:29:58.957206 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 497033597, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:29:59.040977 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 698028417, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
...
How can I find out more about what's going on?