[Proleps]

> I don't know WHY they do this, but last time it happened we got an abuse report saying that we were reported for port scanning from our main firewall / proxy box. Somehow they had reflected traffic off our firewall / proxy to make it try to connect to a bunch of IPs on a known trojan port.

How did you solve it?

[BrenNG]

Not sure it's solved, but I added some additional firewall rules to block certain types of ICMP packets that they were sending and added some additional logging for when it happens again.