Page 1 of 1

How can I block this attack ?

Posted: 03 May 2021, 17:03
by btekcan
Hello,

This is only few lines. We have a maybe tousend of line. And CSF didn't stop this. Which config missing our CSF ?

Regards,

139.880043136 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.882366931 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.884717429 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.887074679 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.889429325 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.891781180 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.894119032 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.896463335 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.898832206 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.901198286 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.903588280 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.905941096 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.908281440 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.910606608 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.912941665 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.915282394 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.917613211 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.919958739 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.922226795 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.924526664 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.926808799 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.929074695 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.931373821 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private
139.933659901 43.239.141.121 -> xxx.xxx.xxx.xxx NTP 482 NTP Version 2, private

Re: How can I block this attack ?

Posted: 24 May 2021, 15:47
by axel50397
Is it from your server (43.239.141.121) or from this IP ?

If it's from outside, simply blacklist the IP. If it's from your server, you'll have to find the script maybe thanks to lfd