Abuse

[ReXpeiTa]

I received this today from the host. Just I have installed teamspeak.

Dear customer,

We have received the following complaint. Could you please take a look at this at your earliest convenience. We as provider merely forward these complaints so you are aware of them. If the complaint is correct, please resolve this issue. If the complaint is incorrect or invalid, please let us know so we can close the case as well.

Below you can find the complaint we have received.
--------------------------------------------------
XXX.XX.XXX.XX was observed probing caltech.edu for security holes. It
has been blocked at our border routers. It may be compromised.

For more info contact [email protected]
Please include the entire subject line of the original message

Greg

(time zone of log is PST, which is UTC-0800, date is MMDD)
log entries are from Cisco netflow, time is flow start time
date time srcIP srcPort dstIP dstPort flags proto #pkts
2016-02-18 20:44:22.999 XXX.XX.XXX.XX 32777 131.215.34.10 69 ...... 17 1
2016-02-18 20:44:46.998 XXX.XX.XXX.XX 27444 131.215.107.200 69 ...... 17 1
2016-02-18 20:44:48.999 XXX.XX.XXX.XX 513 131.215.127.30 69 ...... 17 1
2016-02-18 20:44:49.999 XXX.XX.XXX.XX 1524 131.215.104.216 69 ...... 17 1
2016-02-18 20:44:52.999 XXX.XX.XXX.XX 54320 131.215.44.5 69 ...... 17 1
2016-02-18 20:44:54.999 XXX.XX.XXX.XX 6771 131.215.167.2 69 ...... 17 1
2016-02-18 20:44:54.999 XXX.XX.XXX.XX 1433 131.215.104.216 69 ...... 17 1
2016-02-18 20:44:56.000 XXX.XX.XXX.XX 1524 131.215.4.198 69 ...... 17 1
2016-02-18 20:45:00.999 XXX.XX.XXX.XX 4899 131.215.228.118 69 ...... 17 1
2016-02-18 20:45:01.999 XXX.XX.XXX.XX 2140 131.215.199.2 69 ...... 17 1
2016-02-18 20:45:02.999 XXX.XX.XXX.XX 1243 131.215.38.4 69 ...... 17 1
2016-02-18 20:45:04.999 XXX.XX.XXX.XX 27444 131.215.228.118 69 ...... 17 1
2016-02-18 20:45:05.999 XXX.XX.XXX.XX 31338 131.215.23.66 69 ...... 17 1
2016-02-18 20:45:07.999 XXX.XX.XXX.XX 5800 131.215.199.2 69 ...... 17 1
2016-02-18 20:45:09.999 XXX.XX.XXX.XX 999 131.215.119.187 69 ...... 17 1
2016-02-18 20:45:10.999 XXX.XX.XXX.XX 8080 131.215.44.5 69 ...... 17 1
2016-02-18 20:45:15.999 XXX.XX.XXX.XX 7 131.215.34.10 69 ...... 17 1
2016-02-18 20:45:18.999 XXX.XX.XXX.XX 1 131.215.34.99 69 ...... 17 1
2016-02-18 20:45:20.999 XXX.XX.XXX.XX 20034 131.215.4.198 69 ...... 17 1
2016-02-18 20:45:21.999 XXX.XX.XXX.XX 35555 131.215.23.66 69 ...... 17 1


contact info from:
spamcop hosttracker
whois

 

[kingston]

You were most likely rooted and used for zombie scanning way before you even installed teamspeak. It could be just a coincidence that someone scanned a caltech machine about the same time, which triggered their system to send that automated e-mail to the abuse team of your hoster, based on caltech's router logs.