Curious HTTP related probings.

[scott () WHOI EDU (Scott A . McIntyre)]

For the past few months I've seen some curious web-related probes in the
following pattern:

Wed 03/22 14:06:00 tcp x.x.x.x.2140 > host.whoi.edu.80
Wed 03/22 14:06:46 tcp x.x.x.x.2196 > host.whoi.edu.8080
Wed 03/22 14:07:32 tcp x.x.x.x.2238 > host.whoi.edu.3128

It's always the same three ports, and I know what they typically
represent, however, the destinations are often nodes within our network
address space that don't exist and/or have never existed.

The src address makes no other connection attempts to the box on our
network, and there are no other attempts to contact that destination
box, just this cluster of three pokes.

I'm curious of anyone else has seen such patterns and if they've
discovered any particularly negative results as a consequence of the
probes.

Thanks.

Scott