Where is incoming traffic coming from?

[NoOp]

On 08/02/2009 08:03 PM, Florian Diesch wrote:
> NoOp <glgxg at sbcglobal.net> writes:
> 
>> On 08/02/2009 04:24 PM, Amedee @ Ubuntu wrote:
>> ...
>>> 
>>> FYI: after I added 193.190.67.15 to /etc/shorewall/blacklist and restarted
>>> shorewall, the traffic stopped. To save you a whois: that's Belnet, a very
>>> reputable Belgian research network that interconnects all Belgian
>>> universities and that also has a large Linux mirror. They are supposed to
>>> be "good guys".
>>> 
>>> Weird... but I have no time to investigate at the moment.
>>> 
>>
>> It's a mirror:
>> http://193.190.67.15/mirror/
>> ftp://193.190.67.15/
> 
> It's ftp.belnet.be

Well yes, that's already been established & easy enough to figure out.
$ host 193.190.67.15
15.67.190.193.in-addr.arpa domain name pointer ftp.belnet.be

However if you pop http://193.190.67.15 a browser you get redirected to
http://193.190.67.15/mirror/

What to you suppose the following implies?
====
Welcome to the BELNET public FTP cluster ftp.belnet.be !

This archive is provided through a cluster of 12 dual processor, dual
core Intel Xeon 3 GHz machines, each having 4 GB of RAM. The 16 TB FTP
archive is taken from an iSCSI SATA SAN.

This cluster is located in Brussels, Belgium and operated by BELNET, the
Belgian Education and Research Network. If you have any problem,
question or mirror request, please send them to ftpmaint at belnet.be.
This archive is also available through the following means:
====