<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Source Sans Pro";}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-GB link=blue vlink=purple style='word-wrap:break-word'><div class=WordSection1><div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I have had no reports of abuse with my partial exit for a couple of years, then suddenly OVH kills the server<o:p></o:p></p><p class=MsoNormal>(Reinstalling is a pain and IPV6 not autoloaded and they and Ubuntu keep changing networking) Anyway<o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Source Sans Pro",sans-serif;color:black'><o:p> </o:p></span></p><p class=MsoNormal><i><span style='font-size:10.0pt;font-family:"Source Sans Pro",sans-serif;color:black'>“Abnormal activity has been detected on your VPS vps585081.ovh.net.<br><br>As your VPS poses too greater threat to our infrastructure, we had no choice but to put it in FTP rescue mode. This mode enables you to access the data on your VPS. An email containing information on FTP rescue mode has been sent to you. <br><br>Actions can no longer be carried out on your VPS via your Manager/API. Only the following actions are possible:<br><br>- Reinstallation of your VPS.<br><br>Please do not hesitate to contact our technical support team so that this situation does not become critical.<br><br>You will find the logs brought up by our system below, which led to this alert.<br><br>- START OF ADDITIONAL INFORMATION -<br><br>Attack detail : 7Kpps/3Mbps<br>dateTime srcIp:srcPort dstIp:dstPort protocol flags bytes reason <br>2021.07.17 15:44:37 CEST 51.38.64.xxx:39859 192.124.249.xx:443 TCP SYN 60 ATTACK:TCP_SYN <br>2021.07.17 15:44:37 CEST 51.38.64.xxx:38510 67.222.30.xx:443 TCP SYN 60 ATTACK:TCP_SYN <br>2021.07.17 15:44:37 CEST 51.38.64.xxx :43014 67.222.30.xx:443 TCP SYN 60 ATTACK:TCP_SYN <br><br></span></i><i><o:p></o:p></i></p><p class=MsoNormal>When I fire it up how to mitigate against this? My new server with the original IPV4 address is under attack already but tor is not running yet<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Gerry<o:p></o:p></p></div></div></body></html>