Not terribly unusual, I have a host based firewall that detects them. I put it on the stop list 72.20.207.229


port scan from 72.20.207.229

I do a whois

> whois 72.20.207.229


OrgName: PPL Telcom, LLC
OrgID: PTL-36
Address: 2 North Ninth Street, PL2
City: Allentown
StateProv: PA
PostalCode: 18101
Country: US

NetRange: 72.20.192.0 - 72.20.255.255
CIDR: 72.20.192.0/18

RTechHandle: CMM5-ARIN
RTechName: Moran, Craig M.
RTechPhone: +1-610-774-4362
RTechEmail: CMMoran@pplweb.com
OrgNOCHandle: CMM5-ARIN

OrgNOCName: Moran, Craig M.
OrgNOCPhone: +1-610-774-4362
OrgNOCEmail: CMMoran@pplweb.com
OrgTechHandle: BJG-ARIN

OrgTechName: GITLER, BRIAN J.
OrgTechPhone: +1-610-774-3321
OrgTechEmail: BJGITLER@pplweb.com
OrgTechHandle: WEM-ARIN

OrgTechName: Moore, Wayne E.
OrgTechPhone: +1-610-774-5604
OrgTechEmail: wemoore@pplweb.com

not terribly interesting but when I do a host on that IP I get something I have never seen before

> host 72.20.207.229

229.207.20.72.IN-ADDR.ARPA is a nickname for 229.192/26.207.20.72.IN-ADDR.ARPA
229.192/26.207.20.72.IN-ADDR.ARPA domain name pointer backup1.atown.alcazarnetwo
rks.com

-=- is a nickname -=-

> whois 26.207.20.72

OrgName: DoD Network Information Center
OrgID: DNIC
Address: 3990 E. Broad Street
City: Columbus
StateProv: OH
PostalCode: 43218
Country: US
NetRange: 26.0.0.0 - 26.255.255.255
CIDR: 26.0.0.0/8
NetName: DISANET26
NetHandle: NET-26-0-0-0-1
Parent:
NetType: Direct Allocation
Comment:
RegDate:
Updated: 2006-04-24
OrgTechHandle: MIL-HSTMST-ARIN
OrgTechName: Network DoD
OrgTechPhone: +1-800-365-3642
OrgTechEmail: HOSTMASTER@nic.mil
packetninja:~ ullrey$ whois rks.com
Registrant

RKS Quebec
Domain Administrator
Casier Postale 2490
St-Nicolas, QC (CA)
G7A 4X5

Administrative Contact

RKS Quebec
Domain Administrator
Casier Postale 2490
St-Nicolas, QC (CA)
G7A 4X5
+1.514-954-1905
nationalbrands@gmail.com

Technical Contact

RKS Quebec
Domain Administrator
Casier Postale 2490
St-Nicolas
QC
G7A 4X5
CA
+1.514-954-1905
nationalbrands@gmail.com

Registrar: Rebel.com

So what is this:
  1. A port scan
  2. Whois points to Allentown PA
  3. No web server at that address
  4. host of IP reveals nickname for 26.207.20.72
  5. whois of nickname IP reveals DoD Network Information Center

So I am writing them an email