Homeland Security site misses the slammer worm by a hair

[Gerald Combs]

On Tue, 28 Jan 2003, Jim Herrmann wrote:

> This has got to be a honeypot, don't you think:
> 
> "www.nsa.gov - Microsoft IIS on Windows 2000* - Lingualistek"
>
> Then this:
> "/The website of the National Security Agency shows up as being hosted 
> by Lingualistek, a small tech business in Maryland that runs its own 
> site on Apache and Linux. on Linux."/
> 
> Very curious.

Yeah, it is.  Netcraft says their netblock is owned by Lingualistek:

  http://uptime.netcraft.com/up/graph/?mode_u=off&mode_w=on&site=www.nsa.gov&submit=Examine

ARIN says it's owned by the NSA:

  http://ws.arin.net/cgi-bin/whois.pl?queryinput=65.213.217.241

Nitrous.digex.net says their netblock is advertised by Allegiance Telecom
(AS 2548).

The root name servers say DNS belongs to UUNet.

I'm not sure where Netcraft is getting Lingualistek.  Probably some sort
of conspiracy.