On: Some idiot is using your tool to mass scan our network

[johndbritton]

From the exclude.conf file:

  #Received: from elbmasnwh002.us-ct-eb01.gdeb.com ([153.11.13.41]
  # helo=ebsmtp.gdeb.com) by mx1.gd-ms.com with esmtp (Exim 4.76) (envelope-from
  # <bmandes@gdeb.com>) id 1VS55c-0004qL-0F for support@erratasec.com; Fri, 04
  # Oct 2013 09:06:40 -0400
  #To: <support@erratasec.com>
  #CC: <ebsoc@gdeb.com>
  #Subject: Scanning and Probing our network
  #From: Robert Mandes <bmandes@gdeb.com>
  #Date: Fri, 4 Oct 2013 09:06:36 -0400
  #
  #Stop scanning and probing our network, 153.11.0.0/16.  We are a defense 
  #contractor and report to Federal law enforcement authorities when scans 
  #and probes are directed at our network.  I assume you don't want to be 
  #part of that report.   Please permanently  remove our network range from 
  #your current and future research. 
  #
  #Thank you 
  #
  #Robert Mandes
  #Information Security Officer
  #General Dynamics 
  #Electric Boat 
  #
  #C 860-625-0605
  #P 860-433-1553

https://github.com/robertdavidgraham/masscan/blob/master/dat...

[parliament32 → johndbritton]

I'm more upset about this org managing a /16 than anything.

[ihattendorf → johndbritton]

Cool, now I know to focus my scans on 153.11.0.0/16 if I want anything juicy.

[fsociety → johndbritton]

You would hope a defense contractor was smarter than this but of course they tend not to be... threatening to put a maintainer in a report to Federal law enforcement is weak sauce.