[nsp-sec] Net Scan from AS21844

[Hicks, Howard]

0603.02:43:42.477 0603.02:43:42.477 20    12.96.164.103   80    12    205.161.195.8   1245  6   2  1          40
0603.02:44:51.169 0603.02:44:51.169 63    12.96.164.103   80    38    210.80.96.149   1058  6   2  1          40
0603.03:24:31.387 0603.03:24:31.387 20    12.96.164.103   80    12    205.161.193.184 1106  6   2  1          40
0603.03:54:12.001 0603.03:54:12.001 49    12.96.164.103   80    6     208.46.211.154  1234  6   2  1          40
0603.04:01:59.006 0603.04:01:59.006 38    12.96.164.103   80    5     209.152.123.85  1082  6   2  1          46



AS      | IP               | AS Name
21844   | 12.96.164.103    | THEPLANET-AS - ThePlanet.com Internet Services, Inc.



Qwest is seeing what you believe is a spoofed attack. The planet should be seeing the real responses (resets)

06/03/09 17:08:28 IP block 12.96.164.103 at 65.115.22.213 Trying 12.96.164.103 at ARIN Trying 12.96.164 at ARIN AT&T WorldNet Services ATT (NET-12-0-0-0-1)
                                  12.0.0.0 - 12.255.255.255 THEPLANET.COM INTERNET SERVICES THEPLANE725-160 (NET-12-96-160-0-1)
                                  12.96.160.0 - 12.96.167.255
Regards,

Howard E. Hicks
Qwest Managed Security Services
Monday - Thursday 7:30 18:00
612-664-3021