Full Disclosure mailing list archives
Re: Open proxy scanner experience
From: Valdis.Kletnieks () vt edu
Date: Thu, 10 Apr 2008 12:42:15 -0400
On Thu, 10 Apr 2008 07:30:36 MDT, James Lay said:
So yesterday a network that I do work for had it's mail server scanned. I reported the scan (snort reported nmap -F scan) to the offending netblock owner, thinking that they had a compromised machine. I was surprised to receive an email this morning stating "Oh that's just our open proxy scanner". Now....I've dealt with some open proxy scanners and seeing the activity before, but GOOD GANDHI...they scanned the ENTIRE port range of the machine..it took almost 3 hours from start to finish. Has anyone else seen such aggressive "open proxy" scanning like that?
OK, I'll bite - did they initiate the scan when your mailserver first tried to contact theirs, and greylist you until the scan finished, or were they idiots and accepted the mail before the scan finished, or are they complete and total bozos and they're trying to scan the entire Internet proactively?
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Open proxy scanner experience James Lay (Apr 10)
- Re: Open proxy scanner experience Valdis . Kletnieks (Apr 10)
- Re: Open proxy scanner experience James Lay (Apr 10)
- Re: Open proxy scanner experience Valdis . Kletnieks (Apr 10)