ello David, CERT.br works as a coordinating team for incidents and abuses related to Brazilian networks. This incident cannot be investigated unless you provide the necessary information. Your logs must include the IP addresses involved, protocols (e.g. ICMP, TCP, UDP), port numbers (in case of TCP and UDP protocols), date, time and timezone of the events. The more information you can provide, the better. Please send these data to the technical contact for the offending network, with in the "Cc:" of the message. More specific contacts for the offending networks can be found at our whois server: "whois.nic.br" (.BR domain names, CIDR blocks, IP and AS numbers accepted). You can also find contacts for any network connected to the Internet at: . Be sure to send your logs in plain text (ASCII) format. Please refrain from sending HTML emails and attachments in other formats such as .doc, .xls, .bmp, .gif, etc. Regards, -- CERT.br http://www.cert.br/