It looks like win26 is rebooting on its own, and we are checking it, it is coming up for 45 minute or and hour, then rebooting again, downtimes are small, but had done it 3 times now.
IIS is still down at the moment, and the server is staying more stable, we have found one issue we have stopped a site, but working to a complete resolution, before bringing IIS back up.
one site, that we suspected, is getting hit VERY hard by a botnet with many IPs, we are unsure why this was triggering a reboot, but watching closely and blocking IP ranges attacking.
Even with this + about 800 more now blocked, the attacks are flowing in. We have set it up to deny access for them to anything, but still quite something to watch how many infected machines some group can corral up to attack a site.
There are still IPs attacking this site today, but not getting too far with it. Server has been stable since the IIS came back up as posted here last night.
Some group is mad at this server, and taking attacks to the max, finding new sites with php vulnerabilities, and renewing attacks over and over, it is happening again today and working to stop it again.
They have obviously 1000's of PCs/servers at their disposal
IIS is not stopped, but was slow for a 4-6 minutes, we are checking it out still, but do not expecting any further major impact.