DDoS On My Own Internet? (Not Site)


#1

104.16.119.50 and 104.16.199.132

these ip adresses attacked me when I’m playing League Of Legends. Why?? How could it be possible?

And I speak with attacker. he said “ur ray id” bla bla…

what is that??

https://packettotal.com/app/analysis?id=10e710355d73e1ed455c0e4eb62b8326&name=similar_pcaps


#2

What exactly do you mean here by “attacked”?

Sorry?


#3

yes. he attacked me


#4

that ip adress is attacked my connection. (sorry 4 my bad english)

and he said I can f** u ur ray id and mac address is on my hand.


#5

Can you explain what you mean by attacked? These IP addresses are used for proxying web requests. Only thing I could imagine is someone set up their domain to serve through Cloudflare and proxied against your IP address but that would be slightly weird.

Are you using Cloudflare for a site?


#6

attacked meaning: this ip adresses hitting/crashing my connection. I can’t reach any websites or servers.

I’m not using any site/domain. Only my ISP (turkey, turk telekom) and that 2 ip adress


#7

That’s a Cloudflare IP. You would see this in your webserver logs if you’d have one. There’s no other way to use those IPs for outbound connections. Either it is spoofed or somene set a DNS record pointing to your IP flodding you with HTTP requests.

Do you have a static IP for your internet connection or does it change when you disconnect your router for a while?

How did you know who’s ‘attacking’ you?
Where did you get those two IPs from?


#8

I get writing -netstat on cmd only and I found this 2 ip adress. and I looked my modem on 192.168.1.1, there is a lot of packets sent my modem. (attacking)

but sure, that 2 ip adress is attacking me because “syn_sent” writing on cmd.


#9

and I don’t know my ip adress is changing on resetting modem but is it static or dynamic I don’t know. I only know this 2 ip adresses attacking me.


#10

You are behind NAT. So it’s impossible to see incoming connections with netstat because connections that have been initiated from the internet would not appear in netstat or any other logs on your pc unless you’ve set up a port forwarding or an exposed host.

image

It looks the same on any other OS like linux or Mac.

I’t not the correct place to dig deeper into TCP but the synchronisation (SYN) is a three way handshake.

  1. ‘syn’ - the client sends a SYN packet requesting the connection. (so: you would see a syn_sent)
  2. ‘syn_ack’ - receipient sends an acknowlegdement and his own SYN request
  3. ‘ack’ - Client send’s it’s acknowledgement.
    Connection established

Sure, it is possible that you get SYN flodded. But you wouldn’t see this on your computer, only on your router unles you have port forwardings.
How many connections did you see in netstat?


#11

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.