I've just recently noticed an IP address that has been showing up in our SonicWall logs on a pretty frequent basis. Throughout the course of an average day, we'll see around 100 dropped packets originating from 18.104.22.168, which is in a block of IPs registered to Apple. Here's a sample:
Apr 26 12:59:47 id=firewall sn=0017C5107A2C time="2011-04-26 12:59:47" fw=X.X.X.Y pri=1 c=32 m=179 msg="Probable TCP NULL scan detected" n=0 src=22.214.171.124:48225:X1 dst=X.X.X.Z:80 note="TCP Flag(s): None"
I'm not too concerned -- it's just a TCP NULL scan, and they are only hitting specifically port 80 on just a few of our many IP addresses. That said, I'm still quite curious what the heck is going on :)
I did a little googling WRT that IP address, and didn't find much more than other people's log files and such. Only one post seemed to stand out, but it was a couple months old and hadn't gained much traction.
Anyone else seeing TCP NULL scans from these guys? I'm not sure how long this has been going on, as I only have a couple months of logs archived. I'd be curious to know if this is a fairly recent thing, or if it's been happening for a while.