Re: patternmatch for scan

[Neil Ratzlaff <neil.ratzlaff () ucop edu>]

For the last several months there has been a pattern of scans for http, 
3128, and 8080.
http://www.sans.org/y2k/proxy.htm has a brief comment.

Neil

At 08:56 02/19/00 -0500, Kenneth_W_Fox () sbphrd com wrote:
> Is anyone familiar with an attack or probe which begins or ends with scanning
> only ports 3128 & 8080 on a target box? I've been seeing alot of this 
> lately in
> various places.
>
> Ken