attacker crafts packets with a forged return IP.
they SYN as many of your ports and IPs, you send SYN-ACK to the spoofed IP destination, the destination knows it didnt SYN you and refuses to ACK the connection.
long TTL keeps the connection open longer, and it builds up to a DDOS for you when your ports are all half open.
depending on the real owner of the spoofed IP, they might blacklist your IP for spraying them with syn-ack.
Yes.
No, it's always port 443. But yes, the destination doesn't ACK the connection.
No, the TTL just means it can make more hops; it doesn't mean the connection is kept open for longer.
No, the IP addresses are unique and rarely repeat.
Address: 66.252.224.242 01000010.11111100.11100000. 11110010
Maybe a long forgotten server with some ancient malware that keeps being moved around...
Mysterious