Several probes from

[Fabio Bastiglia Oliva <fboliva () safenetworks com>]

Hello,


We detected several probes (portscans) to a lot of hosts/networks
coming from 63.170.232.2.

These portscans had SYN+FIN (Stealth) flags, origin port 21,
destination port 21.

And after find a "21" port open, it tried to connect to, but it was
trapped by a honeypot.

As I said above... we got the same action in several hosts/networks.

Anyone here got something like this?

check these details:

########################
Snort

#(3 - 7573) [2001-05-20 14:54:41] SCAN synscan portscan

IPv4: 63.170.232.2 -> 200.xxx.xxx.xxx
      hlen=5 TOS=32 dlen=40 ID=39426 flags=0 offset=0 TTL=26 chksum=15737
TCP:  port=21 -> dport: 21  flags=******SF seq=1511872466
      ack=1763444313 off=5 res=0 win=1028 urp=0 chksum=49433
Payload: none

########################
# host 63.170.232.2
2.232.170.63.IN-ADDR.ARPA domain name pointer 007sitehosting.com
2.232.170.63.IN-ADDR.ARPA domain name pointer agonvote.net
2.232.170.63.IN-ADDR.ARPA domain name pointer ns2.dnssrv.net
########################

########################
# whois 63.170.232.2
Sprint (NETBLK-SPRN-BLKS) SPRN-BLKS 63.160.0.0 - 63.175.255.255
TECNICO (NETBLK-FON-106816512052742) FON-106816512052742
63.170.232.0 - 63.170.232.255
########################

########################
Sam Spade
Address Digger Results
(Version 3.1beta)

Let's go!
Official name: 007sitehosting.com

(Aliases: agonvote.net ns2.dnssrv.net)

Addresses: 63.170.232.2

Possible forgery - 007sitehosting.com is claiming to be 63.170.232.2,
but 63.170.232.2 isn't a valid address for 007sitehosting.com

--------------------------------------------------------------------------------

Whois for 007sitehosting.com
.com is the global domain of USA & International Commercial

(Whois queries for .com domains can be performed at http://rs.internic.net/cgi-bin/whois)

whois -h whois.crsnic.net 007sitehosting.com

Redirecting to BULKREGISTER.COM, INC.

SiteJini LLC 
   1822 Northern viola lane
   Rochester, MN 55906
   US

   Domain Name: 007SITEHOSTING.COM

   Administrative Contact:
         Brent Buss    sales () sitejini com
        SiteJini LLC
        1822 Northern viola lane
        Rochester, MN 55906
        US
        Phone- 507-289-3373 
        Fax- 
   Technical Contact:
        Scott Litke  admin () sitegenie com
        SiteGenie, LLC
        1142 9 1/2 Ave SE
        Rochester, Minnesota 55904
        US
        Phone- 507-252-1290 
        Fax- 507-292-0883

   Record updated on 2000-04-29 00:00:00.
   Record created on 2000-04-29.
   Record expires on 2002-04-29.
   Database last updated on 2001-05-19 21:59:53 EST.

   Domain servers in listed order:

   NS2.DNSSRV.NET                63.170.232.2                  
   NS1.DNSSRV.NET                64.208.151.1                  

########################


Best Regards
________________________________
Fabio Bastiglia Oliva - Diretor
fboliva () safenetworks com

Safe Networks Informática LTDA.
http://www.safenetworks.com

"Você acha que está seguro? Nós achamos que não!
 Visite-nos antes que você vire estatística!
               Safe Networks Security Solutions"