scan attacks detected - legit sources

[1dannyd]

I am getting detection notices in both isa and my server event viewer that *these* ip addresses are performing scan attacks. I get 64.156.220.99 five or six times and the 66.14.237.56 five or six times every day. I tried to look them up the best i could and it seems to be bellsouth and gte related but why would they scan?
Thanks for any insight to t6his.

 

[joeb1kenobe]

Both companies are ISPs. Level3 and GTE are providing ISP service through these IPs. The GTE 66.14.237.56 address is in their DSL DHCP pool. These people could be doing these scans wittingly or unwittingly. It maybe that these people have a trojan horse installed being controlled by a client somewhere else. Or it could be spoofed address from the real scan to through you off course.

Joe