comprehensive DNS scans from

Is anyone else seeing DNS ("ls") scan/requests from ?

I have them blocked, but I'm curious as to what they are up to. I asked
once, and they said that they were analyzing the dial-up IP addresses that
were hitting their web pages -- but they are slowly going over hundreds
and hundreds of domain names under our control.

Three weeks back tried a web scan of every machine within
one of our domains. When asked why, their initial response was that they were
mistakenly trying to access an old University e-mail account within the UK.
They then amended this to explain that they were checking everyone who
hit their web site - the same excuse they gave you. However given
the machines they tried talking to included both routers and ATM switches,
this seems just a tad far-fetched ...

I can't see that they did any damage, or generated enough junk traffic, for
this to be a serious operational issue ... more educational perhaps.

Kevin Hoadley, JANET

From their homepage:

  Welcome to Andromedia!

                        We make ARIA 1.0, our award-winning web tracking
software. Push
                        any of the buttons on this page to learn more
about Andromedia and
                        ARIA. Click on the top left-hand button to take
advantage of our free
                        trial of ARIA!

I'm going to give a lookover at their free trial.


Just in case anyone misunderstands the posting I just made (at least one
person already has):

  I have no association with Andromedia. I only posted the info because
people seemed curious about it. I only mentioned getting the trial
version (and I re-read my post and I do apologize for the wording) to
see if that was what was causing the scans.

-Scott Call
CCnet, Inc