Re: Strange FTP log messages

[Steve Kudlak <chromazine () sbcglobal net>]

Andrea Purificato - bunker wrote:

> Alle 16:08, venerdì 24 settembre 2004, ken ha scritto:
>  
>
> > Does anyone recognize this behavior? This has been occurring
> > for a while. I am curious as to what would cause this. This
> > has been happening on a wide range of IPs. Any hints would
> > be appreciated, thanks in advance.
> >    
Well I did a WHOIS and got tthe following  result from that putative IP 
number.
Now remember it has been years since I did lots of this sort of stuff. 
...but I am
pretty sure the info is correct. ...NSLOOKUP seems to confirm  most of it.
You can send them mail and ask them what them are uip to doing. ....

If I had more sleep and had not spent so much time looking at weather maps
and old such strange stuff it might immediately dawn on me as to what is up.
But I really need to sleep.....hope that  starts you on your way.

> 205 /u/chroma> whois 65.82.31.47
> [Querying whois.arin.net]
> [whois.arin.net]
>
> OrgName:    BellSouth.net Inc.
> OrgID:      BELL
> Address:    575 Morosgo Drive
> City:       Atlanta
> StateProv:  GA
> PostalCode: 30324
> Country:    US
>
> ReferralServer: rwhois://rwhois.eng.bellsouth.net:4321
>
> NetRange:   65.80.0.0 - 65.83.255.255
> CIDR:       65.80.0.0/14
> NetName:    BELLSNET-BLK9
> NetHandle:  NET-65-80-0-0-1
> Parent:     NET-65-0-0-0-0
> NetType:    Direct Allocation
> NameServer: NS.BELLSOUTH.NET
> NameServer: NS.ATL.BELLSOUTH.NET
> Comment:
> Comment:    For Abuse Issues, email abuse () bellsouth net. NO 
> ATTACHMENTS. Incl
>  IP
> Comment:    address, time/date, message header, and attack logs.
> Comment:    For Subpoena Request, email ipoperations () bellsouth net 
> with "SUBP
> A" in
> Comment:    the subject line. Law Enforcement Agencies ONLY, please.
> RegDate:    2000-11-28
> Updated:    2003-05-05
>
> AbuseHandle: ABUSE81-ARIN
> AbuseName:   Abuse Group
> AbusePhone:  +1-404-499-5224
> AbuseEmail:  abuse () bellsouth net
>
> TechHandle: JG726-ARIN
> TechName:   Geurin, Joe
> TechPhone:  +1-404-499-5240
> TechEmail:  ipoperations () bellsouth net
>
> OrgAbuseHandle: ABUSE81-ARIN
> OrgAbuseName:   Abuse Group
> OrgAbusePhone:  +1-404-499-5224
> OrgAbuseEmail:  abuse () bellsouth net
>
> OrgTechHandle: JG726-ARIN
> OrgTechName:   Geurin, Joe
> OrgTechPhone:  +1-404-499-5240
> OrgTechEmail:  ipoperations () bellsouth net
>
> # ARIN WHOIS database, last updated 2004-09-24 19:10
> # Enter ? for additional hints on searching ARIN's WHOIS database.
> 206 /u/chroma



Have Fun,
Sends Steve

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html