This is nothing new.
Hi all at GB7CIP for years the subnets hosted at it's gateway. Has all addresses scanned for open ports via the ipip protocol 4 with non 44net source address to 44net address.
These are continous..
All are blocked at this gateway, aS security policy here does not allow Non 44net direct access.
this is juse one current example which is a valid dns entry in this case 12:57:24.052561 IP 169.228.66.251 > 192.168.#.#: IP 85.25.103.50.34680 > 44.131.244.31.8098: Flags [S], seq 2571617267, win 3928, length 0 (ipip-proto-4) Even entries with now DNS entries. 73 de Paul g4apl