AVOID LEECHING FROM THESE SERVERS

207.60-61.*.* : FBI Linux servers used to trap scanners
6.*.*.* : Army Information Systems Center
21.*.*.* : US Defense Information Systems Agency
6.*.*.* : Army Information Systems Center
21.*.*.* : US Defense Information Systems Agency
22.*.*.* : Defense Information Systems Agency
26.*.*.* : Defense Information Systems Agency
29.*.*.* : Defense Information Systems Agency
30.*.*.* : Defense Information Systems Agency
49.*.*.* : Joint Tactical Command
50.*.*.* : Joint Tactical Command
55.*.*.* : Army National Guard Bureau
22.*.*.* : Defense Information Systems Agency
26.*.*.* : Defense Information Systems Agency
29.*.*.* : Defense Information Systems Agency
30.*.*.* : Defense Information Systems Agency
49.*.*.* : Joint Tactical Command
50.*.*.* : Joint Tactical Command
55.*.*.* : Army National Guard Bureau
62.0-30.*.* :
64.224.*.* :
64.225.*.* :
64.226.*.* :
195.10.* :
205.96-103.* :
207.30-120.* :
207.60-61.* :
209.35.*.* :
216.25.* : REAL DANGEROUS
216.247.* : REAL DANGEROUS
217.6.*.* :
155.7.*.* : American Forces Information (NET-AFISHQ-NET1)
155.8.*.* : U.S. ArmyFort Gordon (NET-GORDON-NET5)
155.9.*.* : United States Army Information Systems Command (NET-LWOOD-NET2)
155.74.*.* : PEO STAMIS (NET-CEAP2)
155.75.*.* : US Army Corps of Engineers (NET-CEAP3)
155.76.*.* : PEO STAMIS (NET-CEAP4)
155.77.*.* : PEO STAMIS (NET-CEAP5)
155.78.*.* : PEO STAMIS (NET-CEAP6)
155.79.*.* : US Army Corps of Engineers (NET-CEAP7)
155.80.*.* : PEO STAMIS (NET-CEAP
155.81.*.* : PEO STAMIS (NET-CEAP9)
155.82.*.* : PEO STAMIS (NET-CEAP10)
155.83.*.* : US Army Corps of Enginers (NET-CEAP11)
155.84.*.* : PEO STAMIS (NET-CEAP12)
155.85.*.* : PEO STAMIS (NET-CEAP13)
155.86.*.* : US Army Corps of Engineers (NET-CEAP14)
155.87.*.* : PEO STAMIS (NET-CEAP15)
155.88.*.* : PEO STAMIS (NET-CEAP16)
155.178.*.* : Federal Aviation Administration (NET-FAA)
155.213.*.* : USAISC Fort Benning (NET-FTBENNNET3
155.214.*.* : Director of Information Management (NET-CARSON-TCACC )
155.215.*.* : USAISC-FT DRUM (NET-DRUM-TCACCIS)
155.216.*.* : TCACCIS Project Management Office (NET-FTDIX-TCACCI)
155.217.*.* : Directorate of Information Management (NET- EUSTIS-EMH1)
155.218.*.* : USAISC (NET-WVA-EMH2)
155.219.*.* : DOIM/USAISC Fort Sill (NET-SILL-TCACCIS)
155.220.*.* : USAISC-DOIM (NET-FTKNOX-NET4)
155.221.*.* : USAISC-Ft Ord (NET-FTORD-NET2)
128.47.*.* : Army Communications Electronics Command (NET-TACTNET)
128.50.*.* : Department of Defense (NET-COINS)
128.51.*.* : Department of Defense (NET-COINSTNET)
128.56.*.* : U.S. Naval Academy (NET-USNA-NET)
128.63.*.* : Army Ballistics Research Laboratory (NET-BRL-SUBNET)
128.80.*.* : Army Communications Electronics Command (CECOM) (NET-CECOMNET)
128.98.*.* : Defence Evaluation and Research Agency (NET-DERA-UK)
128.154.*.* : NASA Wallops Flight Facility (NET-WFF-NET)
128.155.*.* : NASA Langley Research Center (NET-LARC-NET)
128.156.*.* : NASA Lewis Network Control Center (NET- LERC)
128.157.*.* : NASA Johnson Space Center (NET-JSC-NET)
128.158.*.* : NASA Ames Research Center (NET-MSFC-NET)
128.159.*.* : NASA Ames Research Center (NET-KSC-NET)
128.160.*.* : Naval Research Laboratory (NET- SSCNET)
128.161.*.* : NASA Ames Research Center (NET-NSN-NET)
128.183.*.* : NASA Goddard Space Flight Center (NET-GSFC)
128.216.*.* : MacDill Air Force Base (NET-CC-PRNET)
128.217.*.* : NASA Kennedy Space Center (NET-NASA-KSC-OIS)
128.236.*.* : U.S. Air Force Academy (NET-USAFA-NET

FBI's honeypot

HoneyNet Project
http://project.honeynet.org/
Know your Ennemy : HoneyNets
http://project.honeynet.org/papers/honeynet/
SANS IDS FAQ : What is Honeypot ?
http://www.sans.org/newlook/resources/IDFAQ/honeypot3.htm
Honey Pots and Intrusion Detection
http://www.sans.org/infosecFAQ/intrusion/honeypots.htm
The Deception Toolkit
http://www.all.net/dtk/index.html
An Explanation of Computer Forensic
http://www.computerforensics.net/forensics.htm
Computer Forensics An Overview
http://www.sans.org/infosecFAQ/incident/forensics.htm
The Forensic Challenge
http://project.honeynet.org/challenge/
Forensic Computer Analysis - An Introduction
http://www.ddj.com/articles/2000/0009/0009f/0009f.htm
The Coroner Toolkit
http://www.fish.com/tct/

207.60.*.* : (FBI's honeypot) The Internet Access Company (NETBLK-TIAC-BLK)
207.60.2.128 - 207.60.2.255 Abacus Technology (NETBLK-TIAC-ABACUSTC)
64.224.* : (FBI's honeypot)
64.225.* : (FBI's honeypot)
64.226.* : (FBI's honeypot)
195.10.* : (FBI's honeypot)
205.96-103.* : (FBI's honeypot)
207.30-120.* : (FBI's honeypot)
207.60-61.* : (FBI's honeypot)
209.35.* : (FBI's honeypot)
216.25.* : (FBI's honeypot)
216.247.* : (FBI's honeypot)
212.159.40.211 : (FBI's honeypot)
212.159.41.173 : (FBI's honeypot)
212.159.0.2 : (FBI's honeypot)
212.159.1.1 : (FBI's honeypot)
212.159.1.4 : (FBI's honeypot)
212.159.1.5 : (FBI's honeypot)
212.56.107.22 : (FBI's honeypot)
212.159.0.2 : (FBI's honeypot)
212.159.33.56 : (FBI's honeypot)
212.56.107.22 : (FBI's honeypot)
139.142.*.* : 139.142.153.23 : Front end portal of a security network filtering hundreds of client subscription IPs. If you find a vulnerable pub, IIS, SQL, or *nix -- LEAVE IT ALONE