@Home Scans

[MeM]

Just wanted to know if anybody else has been hit by @home from this address 65.0.204.91 port 119. The usual scan originates from 24.0.0.203 port 119. Are they doing news scans from this address as well, I checked and this is a legitimate @home address Netblock 65.0.192.0-65.0.207.255 SLKCUT1-UT-2.

[lewis]

Yep, I get the 24.0.0.203 scans all the time but I've never seen the 65 block.

[MeM]

Yep I find it very wierd, I,m watching and waiting..And I guess no one else has seen this address. At first I thought it was probably a spoof of sorts but I don,t think so..

[X2thaZ]

Its probally someone who has just changed the name of thier computer on the net from whatever it wuz to the same thing that that @home scan registers as when it hits your firewall.

[MeM]

That,s possible, i won,t rule that out thanks! But Remember the address was also a legit @Home IP...I want to find out what that block of addys are used for.

[quiet sound]

I emailed abuse@home when I 1st noticed I was getting daily hits from those IPs for a period of two weeks and the response I recieved was that they are used to check the network although they didn't say why. In other words it's @home doing the scanning.

[lewis]

Their usually looking for servers which use up bandwidth.

[MeM]

Thanks for the input!

[rmac]

ok, in regards to the @home scans. You can thank me for that. heh. due to the fact that me and my associate ran ghettohacker.org offa an @home connection and transferred 7 Tb of data in one month. after that @home probed the mess out of everyone looking for open ports and servers. The scans usually occur from . auth-scan.corp.home.net its ok just dont run a server. they will cut ur account.

[Zporttech]

I get them also.......

The firewall has blocked Internet access to your computer (NNTP) from 24.0.0.203 (TCP Port 44484) [TCP Flags: S].

Time: 4/3/2001 13:53:24