Urk, I mis-spoke again. You'd think I never typed or
something. 64.4.0.0 - 64.4.63.255. Also, in looking a little closer
all the packets come with the flags '-AFP'. Being a sensible type I
only allow the S flag for connections that don't already have a state.

I've asked my firewall to save the body of these scans so I'll share
them when hotmail starts scanning again. ;-)

Joshua Jore
Minneapolis Ward 3, precinct 10
  "The irony of this man being imprisoned in the United States and longing
to return to once-Communist Russia so he can regain his right to free
speech is simply staggering." - someone else

On Fri, 24 Aug 2001, Joshua b. Jore wrote:

> Oh sorry, I mis-spoke. It's 64.4.0.0 - 64.4.53.255
>
> Joshua Jore
> Minneapolis Ward 3, precinct 10
>   "The irony of this man being imprisoned in the United States and longing
> to return to once-Communist Russia so he can regain his right to free
> speech is simply staggering." - someone else
>
> On Fri, 24 Aug 2001, Thomas T. Veldhouse wrote:
>
> > This block is not all Hotmail.  At least some of these (i.e. 64.1.x.x is XO)
> > communications.
> >
> > Tom Veldhouse
> > veldy at veldy.net
> >
> > ----- Original Message -----
> > From: "Joshua b. Jore" <josh at greentechnologist.org>
> > To: <tclug-list at mn-linux.org>
> > Sent: Thursday, August 23, 2001 10:12 AM
> > Subject: Re: [TCLUG] hotmail servers scanning...
> >
> >
> > > Hmm... I wouldn't think Hotmail would portscan unrelated IPs to find SMTP
> > > relays on wierd ports. Or did Hotmail turn into an ISP when I wasn't
> > watching?
> > > It's just wierdly coordinated - all these different IPs within the same
> > ARIN
> > > block 64.0.0 - 64.4.63.255 looking at random ports. Dshield hasn't
> > recognized
> > > any IPs I've fed it so I'm not sure what to make of it. I might just phone
> > > the contact for the ARIN block at Hotmail and see if he knows what's going
> > on.
> > >
> > > Joshua Jore
> > > Minneapolis Ward 3, precinct 10
> > >   "The irony of this man being imprisoned in the United States and longing
> > > to return to once-Communist Russia so he can regain his right to free
> > > speech is simply staggering." - someone else
> > >
> > > On Thu, 23 Aug 2001, Liz Burke-Scovill wrote:
> > >
> > > >
> > > > Hey, Josh -
> > > >
> > > > I don't know if this means anything, but while I was working on locking
> > > > down SMTP over here, we were alerted to the problem because earthlink
> > was
> > > > doing scans to make sure we didn't have any open SMTP relays - not
> > always
> > > > on the standard port...perhaps hotmail's doing the same thing OR someone
> > > > going through hotmail is trying to find an opening to spam from?
> > > >
> > > > Liz
> > > >
> > > > On Thu, 23 Aug 2001, Joshua b. Jore wrote:
> > > >
> > > > > Nope, the box getting the connections is MS-free. The only reason
> > hotmail shoudl be talking to my box is to deliver mail or do DNS in the
> > service of mail. In that case I should see connections *to* ports 25 and 53,
> > not *from* 25. It's an idea tho. I just don't use MSN Messenger.
> > > > >
> > > > > Joshua Jore
> > > > > Minneapolis Ward 3, precinct 10
> > > > >   "The irony of this man being imprisoned in the United States and
> > longing
> > > > > to return to once-Communist Russia so he can regain his right to free
> > > > > speech is simply staggering." - someone else
> > > > >
> > > > > On Thu, 23 Aug 2001, doug wrote:
> > > > >
> > > > > > Are you logged on to msn messenger or logged into the hotmail
> > service on any
> > > > > > machine? I'm not sure if messenger uses port 25 for anything or not
> > (believe
> > > > > > it does), but I know it does use non-standard ports as well. I'd
> > find it
> > > > > > hard to believe it's trojaned and snooping you but then again it's
> > M$ so who
> > > > > > really knows what's going on there ;-)
> > > > > > ----- Original Message -----
> > > > > > From: "Joshua b. Jore" <josh at greentechnologist.org>
> > > > > > To: <tclug-list at mn-linux.org>
> > > > > > Sent: Wednesday, August 22, 2001 8:03 PM
> > > > > > Subject: [TCLUG] hotmail servers scanning...
> > > > > >
> > > > > >
> > > > > > > Just a general issue, I've noticed a few IPs from the hotmail.com
> > IP range
> > > > > > > doing some curious scanning. The same IP will try several times to
> > connect
> > > > > > to
> > > > > > > a specific high port and it's always sourced from the smtp port.
> > > > > > >
> > > > > > > I'm including a grep from my firewall log where it shows the
> > hotmail IP,
> > > > > > the
> > > > > > > source port, the destination port (where I blocked the access) and
> > how
> > > > > > many
> > > > > > > times the hotmail IP tried. So what's going on? Is hotmail
> > trojaned or
> > > > > > > something? Am I just missing something important here?
> > > > > > >
> > > > > > > 64.4.55.73 25 8546 6
> > > > > > > 64.4.55.171 25 10273 6
> > > > > > > 64.4.42.33 25 18839 11
> > > > > > > 64.4.49.144 25 44093 11
> > > > > > > 64.4.56.229 25 42600 7
> > > > > > > 64.4.56.203 25 11097 6
> > > > > > > 64.4.56.176 25 21336 5
> > > > > > > 64.4.55.20 25 40832 10
> > > > > > > 64.4.55.155 25 47103 11
> > > > > > > 64.4.42.30 25 29489 11
> > > > > > > 64.4.50.13 25 48844 11
> > > > > > > 64.4.56.226 25 23369 6
> > > > > > >
> > > > > > > Joshua Jore
> > > > > > > Minneapolis Ward 3, precinct 10
> > > > > > >   "The irony of this man being imprisoned in the United States and
> > longing
> > > > > > > to return to once-Communist Russia so he can regain his right to
> > free
> > > > > > > speech is simply staggering." - someone else
> > > > > > >
> > > > > > > _______________________________________________
> > > > > > > tclug-list mailing list
> > > > > > > tclug-list at mn-linux.org
> > > > > > > https://mailman.mn-linux.org/mailman/listinfo/tclug-list
> > > > > > >
> > > > > >
> > > > > > _______________________________________________
> > > > > > tclug-list mailing list
> > > > > > tclug-list at mn-linux.org
> > > > > > https://mailman.mn-linux.org/mailman/listinfo/tclug-list
> > > > > >
> > > > >
> > > > > _______________________________________________
> > > > > tclug-list mailing list
> > > > > tclug-list at mn-linux.org
> > > > > https://mailman.mn-linux.org/mailman/listinfo/tclug-list
> > > > >
> > > >
> > > > --
> > > > Imagination is intelligence having fun...
> > > > e-mail:  kethry at winternet.com
> > > > URL:  http://WWW.winternet.com/~kethry/index.html
> > > >
> > > > _______________________________________________
> > > > tclug-list mailing list
> > > > tclug-list at mn-linux.org
> > > > https://mailman.mn-linux.org/mailman/listinfo/tclug-list
> > > >
> > >
> > > _______________________________________________
> > > tclug-list mailing list
> > > tclug-list at mn-linux.org
> > > https://mailman.mn-linux.org/mailman/listinfo/tclug-list
> > >
> >
> > _______________________________________________
> > tclug-list mailing list
> > tclug-list at mn-linux.org
> > https://mailman.mn-linux.org/mailman/listinfo/tclug-list
> >
>
> _______________________________________________
> tclug-list mailing list
> tclug-list at mn-linux.org
> https://mailman.mn-linux.org/mailman/listinfo/tclug-list
>