Cheeseball,

It appears to be a TCP attack as it's only poking at port 80.

According to ARIN the IP block is owned by Verio.net, a reverse lookup says it's probably been reassigned to nameservers.net. The IP is 209.130.30.130, port numbers used are all over the road.

Looks like I'll be breaking out the sniffer to take a closer look.

whtn0ise,

Thanks for the tips so far.

Any other help would be greatly appreciated.

Thanks,
Stuart