mailing list archives
Re: Open proxy scanner experience
From: James Lay <jlay () slave-tothe-box net>
Date: Thu, 10 Apr 2008 13:36:41 -0600
On 4/10/08 10:42 AM, "Valdis.Kletnieks () vt edu" <Valdis.Kletnieks () vt edu>
On Thu, 10 Apr 2008 07:30:36 MDT, James Lay said:
So yesterday a network that I do work for had it's mail server scanned. I
reported the scan (snort reported nmap -F scan) to the offending netblock
owner, thinking that they had a compromised machine. I was surprised to
receive an email this morning stating "Oh that's just our open proxy
scanner". Now....I've dealt with some open proxy scanners and seeing the
activity before, but GOOD GANDHI...they scanned the ENTIRE port range of the
machine..it took almost 3 hours from start to finish. Has anyone else seen
such aggressive "open proxy" scanning like that?
OK, I'll bite - did they initiate the scan when your mailserver first
tried to contact theirs, and greylist you until the scan finished, or were
they idiots and accepted the mail before the scan finished, or are they
complete and total bozos and they're trying to scan the entire Internet
I have no clue as the outgoing mail system isn't under my control.
Considering it's a US company that doesn't do international business, and
the remote/scanning host is in Russia, I kinda doubt it ;)
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/