Maybe victim of nmap idle scan ?