I guess just in case I was running some perl script I downloaded off of Matt's Script Archive on port 7888
plindner@arcwelder:[beaker]/google3$ host 172.25.65.58
58.65.25.172.in-addr.arpa domain name pointer security-scanner-amer-3.cbf.corp.google.com.
But it appears I can't make it stop :(
https://scarf.googleplex.com/checkip?target=100.109.7.129&list=
05:52:51.515942 IP 172.25.65.58.43577 > 100.109.7.129.7888: Flags [P.], seq 0:432, ack 1, win 229, options [nop,nop,TS val 1188697399 ecr 2097041011], length 432
0x0000: 4560 01e4 1784 4000 3b06 ccee ac19 413a E.....@.;.....A:
0x0010: 646d 0781 aa39 1ed0 c325 02b0 5897 25e2 dm...9...%..X.%.
0x0020: 8018 00e5 069a 0000 0101 080a 46da 1537 ............F..7
0x0030: 7cfe 4e73 4745 5420 2f66 6f72 6d2f 6175 |.NsGET./form/au
0x0040: 6b74 696f 6e2e 6367 693f 6d65 6e75 653d ktion.cgi?menue=
0x0050: 2e2e 2f2e 2e2f 2e2e 2f2e 2e2f 2e2e 2f2e ../../../../../.
0x0060: 2e2f 2e2e 2f2e 2e2f 2e2e 2f65 7463 2f70 ./../../../etc/p
0x0070: 6173 7377 6420 4854 5450 2f31 2e31 0d0a asswd.HTTP/1.1..
0x0080: 486f 7374 3a20 6172 6377 656c 6465 722e Host:.arcwelder.
0x0090: 6d74 762e 636f 7270 2e67 6f6f 676c 652e mtv.corp.google.
0x00a0: 636f 6d3a 3738 3838 0d0a 4163 6365 7074 com:7888..Accept
0x00b0: 2d43 6861 7273 6574 3a20 6973 6f2d 3838 -Charset:.iso-88
0x00c0: 3539 2d31 2c75 7466 2d38 3b71 3d30 2e39 59-1,utf-8;q=0.9
0x00d0: 2c2a 3b71 3d30 2e31 0d0a 4163 6365 7074 ,*;q=0.1..Accept
0x00e0: 2d4c 616e 6775 6167 653a 2065 6e0d 0a43 -Language:.en..C
#googplus