DonQuixote
07-25-2015, 04:15 PM
funaddaa
I'm am very sorry that i have to terminate your VPS instance from my giveaway.
I have received an email from Amazon that you are using the it for port scanning which is violation of the TOS.
Your actions will compromise my AWS account and it will affect all the VPS instances that has been shared from the giveaway.
All of you that are using VPS from my previous giveaway, please do not use it on illegal activities so that i wil still be willing to giveaway in the future.
Thank you very much.
Sorry again funaddaa
--------------------
We've received a report that your instance(s):
Instance Id: i-e4856812
has been port scanning remote hosts on the Internet; check the information provided below by the abuse reporter.
This is specifically forbidden in our User Agreement: AWS Customer Agreement (http://aws.amazon.com/agreement/)
Please immediately restrict the flow of traffic from your instances(s) to cease disruption to other networks and reply this email to send your reply of action to the original abuse reporter. This will activate a flag in our ticketing system, letting us know that you have acknowledged receipt of this email.
It's possible that your environment has been compromised by an external attacker. It remains your responsibility to ensure that your instances and all applications are secured. The link 301 Moved Permanently (http://developer.amazonwebservices.com/connect/entry.jspa?externalID=1233)
provides some suggestions for securing your instances.
Case number: 15256802235-1
Additional abuse report information provided by original abuse reporter:
* Destination IPs:
* Destination Ports:
* Destination URLs:
* Abuse Time: Sat Jul 25 10:46:59 UTC 2015
* Log Extract:
<<<
2015-07-25 10:47:47.992262 IP (tos 0x2,ECT(0), ttl 128, id 6762, offset 0, flags [DF], proto TCP (6), length 52)
172.31.16.24.51931 > 146.20.73.239.3389: Flags [SEW], cksum 0xfa78 (correct), seq 46187382, win 8192, options [mss 8961,nop,wscale 8,nop,nop,sackOK], length 0
2015-07-25 10:47:48.002326 IP (tos 0x2,ECT(0), ttl 128, id 11790, offset 0, flags [DF], proto TCP (6), length 52)
172.31.16.24.51932 > 146.20.73.240.3389: Flags [SEW], cksum 0x8034 (correct), seq 2494933955, win 8192, options [mss 8961,nop,wscale 8,nop,nop,sackOK], length 0
2015-07-25 10:47:48.002360 IP (tos 0x2,ECT(0), ttl 128, id 7148, offset 0, flags [DF], proto TCP (6), length 52)
172.31.16.24.51933 > 146.20.73.241.3389: Flags [SEW], cksum 0x77b8 (correct), seq 3828114630, win 8192, options [mss 8961,nop,wscale 8,nop,nop,sackOK], length 0
2015-07-25 10:47:48.002367 IP (tos 0x2,ECT(0), ttl 128, id 27457, offset 0, flags [DF], proto TCP (6), length 52)
172.31.16.24.51934 > 146.20.73.242.3389: Flags [SEW], cksum 0xdaf6 (correct), seq 206952797, win 8192, options [mss 8961,nop,wscale 8,nop,nop,sackOK], length 0
2015-07-25 10:47:48.002373 IP (tos 0x2,ECT(0), ttl 128, id 23773, offset 0, flags [DF], proto TCP (6), length 52)
172.31.16.24.51935 > 146.20.73.243.3389: Flags [SEW], cksum 0xc625 (correct), seq 2157017584, win 8192, options [mss 8961,nop,wscale 8,nop,nop,sackOK], length 0
I'm am very sorry that i have to terminate your VPS instance from my giveaway.
I have received an email from Amazon that you are using the it for port scanning which is violation of the TOS.
Your actions will compromise my AWS account and it will affect all the VPS instances that has been shared from the giveaway.
All of you that are using VPS from my previous giveaway, please do not use it on illegal activities so that i wil still be willing to giveaway in the future.
Thank you very much.
Sorry again funaddaa
--------------------
We've received a report that your instance(s):
Instance Id: i-e4856812
has been port scanning remote hosts on the Internet; check the information provided below by the abuse reporter.
This is specifically forbidden in our User Agreement: AWS Customer Agreement (http://aws.amazon.com/agreement/)
Please immediately restrict the flow of traffic from your instances(s) to cease disruption to other networks and reply this email to send your reply of action to the original abuse reporter. This will activate a flag in our ticketing system, letting us know that you have acknowledged receipt of this email.
It's possible that your environment has been compromised by an external attacker. It remains your responsibility to ensure that your instances and all applications are secured. The link 301 Moved Permanently (http://developer.amazonwebservices.com/connect/entry.jspa?externalID=1233)
provides some suggestions for securing your instances.
Case number: 15256802235-1
Additional abuse report information provided by original abuse reporter:
* Destination IPs:
* Destination Ports:
* Destination URLs:
* Abuse Time: Sat Jul 25 10:46:59 UTC 2015
* Log Extract:
<<<
2015-07-25 10:47:47.992262 IP (tos 0x2,ECT(0), ttl 128, id 6762, offset 0, flags [DF], proto TCP (6), length 52)
172.31.16.24.51931 > 146.20.73.239.3389: Flags [SEW], cksum 0xfa78 (correct), seq 46187382, win 8192, options [mss 8961,nop,wscale 8,nop,nop,sackOK], length 0
2015-07-25 10:47:48.002326 IP (tos 0x2,ECT(0), ttl 128, id 11790, offset 0, flags [DF], proto TCP (6), length 52)
172.31.16.24.51932 > 146.20.73.240.3389: Flags [SEW], cksum 0x8034 (correct), seq 2494933955, win 8192, options [mss 8961,nop,wscale 8,nop,nop,sackOK], length 0
2015-07-25 10:47:48.002360 IP (tos 0x2,ECT(0), ttl 128, id 7148, offset 0, flags [DF], proto TCP (6), length 52)
172.31.16.24.51933 > 146.20.73.241.3389: Flags [SEW], cksum 0x77b8 (correct), seq 3828114630, win 8192, options [mss 8961,nop,wscale 8,nop,nop,sackOK], length 0
2015-07-25 10:47:48.002367 IP (tos 0x2,ECT(0), ttl 128, id 27457, offset 0, flags [DF], proto TCP (6), length 52)
172.31.16.24.51934 > 146.20.73.242.3389: Flags [SEW], cksum 0xdaf6 (correct), seq 206952797, win 8192, options [mss 8961,nop,wscale 8,nop,nop,sackOK], length 0
2015-07-25 10:47:48.002373 IP (tos 0x2,ECT(0), ttl 128, id 23773, offset 0, flags [DF], proto TCP (6), length 52)
172.31.16.24.51935 > 146.20.73.243.3389: Flags [SEW], cksum 0xc625 (correct), seq 2157017584, win 8192, options [mss 8961,nop,wscale 8,nop,nop,sackOK], length 0