[100770] in North American Network Operators' Group
Re: Abusive traffic from Microsoft China?
daemon@ATHENA.MIT.EDU (goemon@anime.net)
Thu Nov 8 13:29:40 2007
Date: Thu, 8 Nov 2007 10:28:46 -0800 (PST)
From: goemon@anime.net
To: David Hubbard <dhubbard@dino.hostasaurus.com>
cc: nanog@merit.edu
In-Reply-To: <FCD26398C5EDE746BFC47F43EA52A173024D7A8D@dino.ad.hostasaurus.com>
Errors-To: owner-nanog@merit.edu
What are you seeing? port 80 traffic? port 25?
thousands of random connections sounds like web indexing to me.
-Dan
On Thu, 8 Nov 2007, David Hubbard wrote:
>
> Just wondering if anyone else is seeing huge random
> floods of traffic from:
>
> inetnum: 202.96.51.128 - 202.96.51.255
> netname: MICROSOFT-CO
> descr: Microsft (China) Co.Ltd
> country: CN
> admin-c: CH455-AP
> tech-c: SY21-AP
> mnt-by: MAINT-CNCGROUP-BJ
> changed: suny@publicf.bta.net.cn 20060926
> status: ALLOCATED NON-PORTABLE
> source: APNIC
> changed: suny@publicf.bta.net.cn 20060926
>
> On a nearly daily basis we see them randomly open
> thousands of connections from a variety of addresses
> in that block to multiple servers. I've emailed
> of coruse but that results in nothing. Probably
> will just end up blocking them.
>
> Thanks,
>
> David
>
