Not terribly unusual, I have a host based firewall that detects them. I put it on
the stop list 72.20.207.229
port scan from 72.20.207.229
I do a whois
> whois 72.20.207.229
OrgName: PPL Telcom, LLC
OrgID: PTL-36
Address: 2 North Ninth Street, PL2
City: Allentown
StateProv: PA
PostalCode: 18101
Country: US
NetRange: 72.20.192.0 - 72.20.255.255
CIDR: 72.20.192.0/18
RTechHandle: CMM5-ARIN
RTechName: Moran, Craig M.
RTechPhone: +1-610-774-4362
RTechEmail: CMMoran@pplweb.com
OrgNOCHandle: CMM5-ARIN
OrgNOCName: Moran, Craig M.
OrgNOCPhone: +1-610-774-4362
OrgNOCEmail: CMMoran@pplweb.com
OrgTechHandle: BJG-ARIN
OrgTechName: GITLER, BRIAN J.
OrgTechPhone: +1-610-774-3321
OrgTechEmail: BJGITLER@pplweb.com
OrgTechHandle: WEM-ARIN
OrgTechName: Moore, Wayne E.
OrgTechPhone: +1-610-774-5604
OrgTechEmail: wemoore@pplweb.com
not terribly interesting but when I do a host on that IP I get
something I have never seen before
> host 72.20.207.229
229.207.20.72.IN-ADDR.ARPA is a nickname for 229.192/26.207.20.72.IN-ADDR.ARPA
229.192/26.207.20.72.IN-ADDR.ARPA domain name pointer backup1.atown.alcazarnetwo
rks.com
-=- is a nickname -=-
> whois 26.207.20.72
OrgName: DoD Network Information Center
OrgID: DNIC
Address: 3990 E. Broad Street
City: Columbus
StateProv: OH
PostalCode: 43218
Country: US
NetRange: 26.0.0.0 - 26.255.255.255
CIDR: 26.0.0.0/8
NetName: DISANET26
NetHandle: NET-26-0-0-0-1
Parent:
NetType: Direct Allocation
Comment:
RegDate:
Updated: 2006-04-24
OrgTechHandle: MIL-HSTMST-ARIN
OrgTechName: Network DoD
OrgTechPhone: +1-800-365-3642
OrgTechEmail: HOSTMASTER@nic.mil
packetninja:~ ullrey$ whois rks.com
Registrant
RKS Quebec
Domain Administrator
Casier Postale 2490
St-Nicolas, QC (CA)
G7A 4X5
Administrative Contact
RKS Quebec
Domain Administrator
Casier Postale 2490
St-Nicolas, QC (CA)
G7A 4X5
+1.514-954-1905
nationalbrands@gmail.com
Technical Contact
RKS Quebec
Domain Administrator
Casier Postale 2490
St-Nicolas
QC
G7A 4X5
CA
+1.514-954-1905
nationalbrands@gmail.com
Registrar: Rebel.com
So what is this:
- A port scan
- Whois points to Allentown PA
- No web server at that address
- ¥ host of IP reveals nickname for 26.207.20.72
- ¥ whois of nickname IP reveals DoD Network Information Center
So I am writing them an email