Текст абузы:
---- Original message ----
We observed machines under your control participating in a DDoS attack
targeting Google IPs.
The attack was a UDP amplification attack. In this attack, a UDP-based
service is abused to attack others, wasting your bandwidth and computing
resources. For more information about this style of attack, see
https://www.us-cert.gov/ncas/alerts/TA14-017A
The participating IPs under your control are listed below, along with
the port number abused, the start and stop times in UTC, and the
approximate amount of data sent during that time.
+-----------------+------+------------------+------------------+--------+
| Amplifier | Port | First Seen (UTC) | Last Seen (UTC) | Mbytes |
+-----------------+------+------------------+------------------+--------+
| 000.000.000.000 | 111 | 2018-09-25 17:28 | 2018-09-25 18:30 | 467 |
+-----------------+------+------------------+------------------+--------+
Note that this is simply a misconfigured server, not an abusive customer
or a compromised machine.
To resolve this incident, please configure or firewall your server so it
does not accept UDP requests to the listed port from untrusted third
parties.
Damian
Правильно ли я понимаю, что с моего сервера, с 111 порта идет UDP трафик? Следующая команда решит проблему?
iptables -A OUTPUT -p udp --sport 111 -j DROP
