Hi, folks - this may have been my fault, and not an attack. There are some nodes in the network that I think connect only to one of the public nodes I'm hosting, and I managed to let my public nodes break for a few hours.
(If you're curious -- my Frantech DDoS-protected one has a problem where it doesn't time-sync properly when it reboots, because the NTP packets don't get through the DDoS filtering. So it rebooted and then had an incorrect time, and started going off on its own.)
If anyone knows the Frantech ecosystem well enough to suggest how I can get NTP working on one of their DDoS-shielded nodes, I'd love to know. I'll work on it in any event and add more alerting in case it goes down again. Frantech seems to reboot it every few months.
And if you're a miner who connects only to my nodes, I'd suggest diversifying and adding some from the list ziiip posts occasionally!
That might explain it. Does frantech block your outbound NTP traffic? I would assume if they blocked it they would provide an NTP server on their net you could use. I can see how poorly configured ddos protection may interfere with the response from NTP, may have to tunnel somewhere else to a stratum 2 server that you host.