This is small output from tcpdump -i re1 'port 25'
:
14:00:10.732034 IP cf-190-93-254-113.cloudflare.com.http > MY_IP.smtp: S 4234708404:4234708404(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>
14:00:10.747464 IP cf-190-93-252-90.cloudflare.com.http > MY_IP.smtp: S 2396112716:2396112716(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>
14:00:10.790744 IP cf-190-93-255-113.cloudflare.com.http > MY_IP.smtp: S 1218828436:1218828436(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>
14:00:10.804055 IP cf-190-93-254-113.cloudflare.com.http > MY_IP.smtp: S 1973146744:1973146744(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>
Or this output from tcpdump -n src net 190.93.0.0/16
:
13:59:14.388684 IP 190.93.254.113.80 > MY_IP.25: S 2997821316:2997821316(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>
13:59:14.394882 IP 190.93.254.113.80 > MY_IP.110: S 3076994870:3076994870(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>
13:59:14.407414 IP 190.93.252.90.80 > MY_IP.25: S 943264969:943264969(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>
13:59:14.416960 IP 190.93.255.113.80 > MY_IP.110: S 3406738447:3406738447(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>
13:59:14.435186 IP 190.93.255.113.80 > MY_IP.25: S 1205583072:1205583072(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>
13:59:14.460652 IP 190.93.254.113.80 > MY_IP.25: S 4135984739:4135984739(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>
I'm not a user of cloudflare.com
.
I want to know what's going on????
cloudflare.com was hacked or...???
I added this IPs to firewall rules and asked my provader to filter this traffic, but I can't understand...