[RichieBoy67]

Originally Posted by final kaoss

A bit like this. Server ip and domain it was sent from is found.

Received: by 10.64.236.40 with SMTP id ur8csp270236iec;
        Sat, 16 Aug 2014 22:01:33 -0700 (PDT)
X-Received: by 10.236.129.3 with SMTP id g3mr42503511yhi.67.1408251693456;
        Sat, 16 Aug 2014 22:01:33 -0700 (PDT)
Return-Path: <bounce-md_30152195.53f036ff.v1-4a68e3a9c92a4da1abcc77bffb4b1933@mandrillapp.com>
Received: from cloudmail.curse.com (cloudmail.curse.com. [205.201.137.179])
        by mx.google.com with ESMTPS id k26si17311804yhh.188.2014.08.16.22.01.33

I obviously know the sending server ip can be found in the mail header. My question was not how it is done but how do you know it is being done? It seems a very unlikely way for a site to be attacked.

My first question still stands as well. What does the security log show that represents a ddos attack and what ports are being targeted? My servers and most if not all others are probed hundreds if not thousands of times daily. These do not represent attacks and I am curious if that is what is happening here. And how is email being tied to this? What is the evidence of it?