Is VPNFilter trying to revive? Someone's scanning Ukrainian nets for port 2000
jask.com