So what's latest Blog is useless and i had no joy from the Responder policy i see no hits on it and my Netscalers are still rebooting is there going to be another responder policy (I might give Ryans a try) ? or is it just sit and wait it out for the new patched firmware? I tried to mitigate as best as i can such as now geofencing the GW URL on FW so will see if that helps.

The main IP used is 213.209.159.55, which is acted as BAD by brightcloud / opentext, which is the IP-DB for IP-Reputation on NetScaler. Are you on premium license? I would recommend to deploy IP-Reputation and bind it globally or bind it to your NSGW / AAA vServers

yeah got premium i used IP repuation before so will get it set up now

I would second Julian's recommendation. We have a Responder Policy for CLIENT.IP.SRC.IPREP_IS_MALICIOUS on all our vServers.

image.png

Support isn't any more help, they won't even confirm that it is a security incident.