[102880] in North American Network Operators' Group

home help back first fref pref prev next nref lref last post

Re: Scan traffic from 121.8.0.0/16

daemon@ATHENA.MIT.EDU (Patrick Clochesy)
Thu Mar 6 15:13:17 2008

Date: Thu, 6 Mar 2008 12:07:34 -0800 (PST)
From: Patrick Clochesy <patrick@chegg.com>
To: Rich Sena <ras@thick.net>
Cc: NANOG <nanog@merit.edu>
In-Reply-To: <Pine.LNX.4.64.0803061500590.21778@noc1>
Errors-To: owner-nanog@merit.edu


------=_Part_6682_6430711.1204834054972
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit

Probably not spoofed, I see a lot of scanning from China. 

route: 121.8.0.0/13 
descr: From Guangdong Network of ChinaTelecom 
origin: AS4134 
mnt-by: MAINT-CHINANET 
changed: dingsy@cndata.com 20060707 
source: APNIC 

person: Chinanet Hostmaster 
nic-hdl: CH93-AP 
e-mail: anti-spam@ns.chinanet.cn.net 
address: No.31 ,jingrong street,beijing 
address: 100032 
phone: +86-10-58501724 
fax-no: +86-10-58501724 
country: CN 
changed: dingsy@cndata.com 20070416 
mnt-by: MAINT-CHINANET 
source: APNIC 

-Patrick 

----- Original Message ----- 
From: "Rich Sena" <ras@thick.net> 
To: "NANOG" <nanog@merit.edu> 
Sent: Thursday, March 6, 2008 12:01:52 PM (GMT-0800) America/Los_Angeles 
Subject: Scan traffic from 121.8.0.0/16 


Anyone seeing anything similar - trying to determine if this is spoofed 
etc... 

-- 
Rich Sena - ras@thick.net 
ThickNET Consulting 
"On the way to understanding; you understand, and forget." 


------=_Part_6682_6430711.1204834054972
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<html><head><style type=3D'text/css'>body { font-family: 'Times New Roman';=
 font-size: 12pt; color: #000000}</style></head><body>Probably not spoofed,=
 I see a lot of scanning from China.<br><br>route:&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp; 121.8.0.0/13<br>descr:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp; From Guangdong Network of ChinaTelecom<br>origin:&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp; AS4134<br>mnt-by:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MA=
INT-CHINANET<br>changed:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dingsy@cndata.com 20=
060707<br>source:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; APNIC<br><br>person:&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Chinanet Hostmaster<br>nic-hdl:&nbsp;&n=
bsp;&nbsp;&nbsp;&nbsp; CH93-AP<br>e-mail:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p; anti-spam@ns.chinanet.cn.net<br>address:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; N=
o.31 ,jingrong street,beijing<br>address:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 100=
032<br>phone:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; +86-10-58501724<br>=
fax-no:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; +86-10-58501724<br>country:&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp; CN<br>changed:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; din=
gsy@cndata.com 20070416<br>mnt-by:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MAIN=
T-CHINANET<br>source:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; APNIC<br><br>-Pat=
rick<br><br>----- Original Message -----<br>From: "Rich Sena" &lt;ras@thick=
.net&gt;<br>To: "NANOG" &lt;nanog@merit.edu&gt;<br>Sent: Thursday, March 6,=
 2008 12:01:52 PM (GMT-0800) America/Los_Angeles<br>Subject: Scan traffic f=
rom 121.8.0.0/16<br><br><br>Anyone seeing anything similar - trying to dete=
rmine if this is spoofed <br>etc...<br><br>-- <br>Rich Sena - ras@thick.net=
<br>ThickNET Consulting<br>"On the way to understanding; you understand, an=
d forget."<br><br></body></html>
------=_Part_6682_6430711.1204834054972--
home help back first fref pref prev next nref lref last post