Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Open proxy scanner experience
From: Valdis.Kletnieks () vt edu
Date: Thu, 10 Apr 2008 12:42:15 -0400

On Thu, 10 Apr 2008 07:30:36 MDT, James Lay said:

So yesterday a network that I do work for had it's mail server scanned.  I
reported the scan (snort reported nmap -F scan) to the offending netblock
owner, thinking that they had a compromised machine.  I was surprised to
receive an email this morning stating "Oh that's just our open proxy
scanner".  Now....I've dealt with some open proxy scanners and seeing the
activity before, but GOOD GANDHI...they scanned the ENTIRE port range of the
machine..it took almost 3 hours from start to finish.  Has anyone else seen
such aggressive "open proxy" scanning like that?

OK, I'll bite - did they initiate the scan when your mailserver first
tried to contact theirs, and greylist you until the scan finished, or were
they idiots and accepted the mail before the scan finished, or are they
complete and total bozos and they're trying to scan the entire Internet

Attachment: _bin

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]