selam. şimdiden yardımlarınız için teşekkürler. server4you netten kullandığım server üzerinden saldırı yapılıyor uyarısı ile durduruyorlar. arada bir oluyor. yaptığımı söyleyeyim önce server içerisinde bulunan bir siteden diğer siteye veri aktarmak için bot kullanıyorum daha kolayıma geldi. Çektiğim veri yüksek olduğu için her 2-3 saniyede bir kayıt giriyor, bundan dolayı bu uyarıyı alıyor olabilir miyim.. işin güzel tarafı veriyi çektiğim ve kayıt ettiğim site ip adresleri uyarıda belirtilen ip adresi değil..

LÜTFEN AŞAĞIDAKİ UYARIYI BANA ANLAŞILIR BİR ŞEKİLDE AÇIKLAYA BİLİRMİSİNİZ. 2-3 defa oldu ama tam anlamı ile anlayamadım.
benim yaptıklarımdan dolayı değil ise önlemini nasıl almalıyım.

<_______________________________________________ >

You appear to be running an open recursive resolver at IP address 85.25.xx.41 that participated in an attack against a customer of ours, generating large UDP responses to spoofed queries, with those responses becoming fragmented because of their size.

Please consider reconfiguring your resolver in one or more of these ways:

- To only serve your customers and not respond to outside IP addresses (in BIND, this is done by defining a limited set of hosts in "allow-query"; with a Windows DNS server, you would need to use firewall rules to block external access to UDP port 53)
- To only serve domains that it is authoritative for (in BIND, this is done by defining a limited set of hosts in "allow-query" for the server overall but setting "allow-query" to "any" for each zone)
- To rate-limit responses to individual source IP addresses (such as by using DNS Response Rate Limiting or iptables rules)

More information on this type of attack and what each party can do to mitigate it can be found here: [url]http://www.us-cert.gov/ncas/alerts/TA13-088A[/url]

If you are an ISP, please also look at your network configuration and make sure that you do not allow spoofed traffic (that pretends to be from external IP addresses) to leave the network. Hosts that allow spoofed traffic make possible this type of attack.

Example DNS responses from your resolver during this attack are given below. 
Date/timestamps (far left) are UTC.

2015-02-01 05:27:16.122309 IP (tos 0x0, ttl 110, id 30981, offset 0, flags [+], proto UDP (17), length 1500) 85.25.xx.41.53 > 208.146.44.x.778: 60111| 27/0/1 uzuzuu.ru. A 77.222.61.195, uzuzuu.ru.[|domain]
	0x0000:  4500 05dc 7905 2000 6e11 ee35 5519 6e29  E...y...n..5U.n)
	0x0010:  d092 2c01 0035 030a 0f46 fa96 eacf 8380  ..,..5...F......
	0x0020:  0001 001b 0000 0001 0675 7a75 7a75 7502  .........uzuzuu.
	0x0030:  7275 0000 ff00 01c0 0c00 0100 0100 0001  ru..............
	0x0040:  0a00 044d de3d c3c0 0c00 0200 0100 0001  ...M.=..........
	0x0050:  0a00                                     ..
2015-02-01 05:27:16.122610 IP (tos 0x0, ttl 110, id 30982, offset 0, flags [+], proto UDP (17), length 1500) 85.25.xx.41.53 > 208.146.44.x.778: 60111| 27/0/1 uzuzuu.ru. A 77.222.61.195, uzuzuu.ru.[|domain]
	0x0000:  4500 05dc 7906 2000 6e11 ee34 5519 6e29  E...y...n..4U.n)
	0x0010:  d092 2c01 0035 030a 0f46 fa96 eacf 8380  ..,..5...F......
	0x0020:  0001 001b 0000 0001 0675 7a75 7a75 7502  .........uzuzuu.
	0x0030:  7275 0000 ff00 01c0 0c00 0100 0100 0001  ru..............
	0x0040:  0a00 044d de3d c3c0 0c00 0200 0100 0001  ...M.=..........
	0x0050:  0a00                                     ..
2015-02-01 05:27:16.122957 IP (tos 0x0, ttl 110, id 30983, offset 0, flags [+], proto UDP (17), length 1500) 85.25.xx.41.53 > 208.146.44.x.778: 60111| 27/0/1 uzuzuu.ru. A 77.222.61.195, uzuzuu.ru.[|domain]
	0x0000:  4500 05dc 7907 2000 6e11 ee33 5519 6e29  E...y...n..3U.n)
	0x0010:  d092 2c01 0035 030a 0f46 fa96 eacf 8380  ..,..5...F......
	0x0020:  0001 001b 0000 0001 0675 7a75 7a75 7502  .........uzuzuu.
	0x0030:  7275 0000 ff00 01c0 0c00 0100 0100 0001  ru..............
	0x0040:  0a00 044d de3d c3c0 0c00 0200 0100 0001  ...M.=..........
	0x0050:  0a00                                     ..

(The final octet of our customer's IP address is masked in the above output because some automatic parsers become confused when multiple IP addresses are included. The value of that octet is "1".)

-John
President
Nuclearfallout, Enterprises, Inc. (NFOservers.com)

(We're sending out so many of these notices, and seeing so many auto-responses, that we can't go through this email inbox effectively. If you have follow-up questions, please contact us at [email]noc@nfoe.net[/email].)