OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Bukys, Liudvikas (bukys_at_rochester.edu)
Date: Mon Jul 29 2002 - 13:34:38 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    We have seen a large increase in the number of port scanners checking ports
    80, 81, 1080, 3128 (Squid), 4480 (Proxy+), 6588 (AnalogX), 8000, 8080, 8081
    for open proxies.

    A few days ago when I checked, the test pattern was a
            GET http://www.yahoo.com HTTP/1.0

    The most recent scan I observed added more ports (the 4480 and 6588 are new),
    and now the test pattern is a
            CONNECT ipaddress:25 HTTP/1.0
    where ipaddress is a different host than the scanner.

    Somebody is collecting web proxies. I am interested in hearing whether
    other sites are seeing this, or whether it's somebody uniquely focussed
    on my site.

    Liudvikas Bukys
    University of Rochester
    bukysrochester.edu
    585-275-7747

    Details from http access log (most recent scanner):
    66.60.157.246 - - [28/Jul/2002:02:44:43 -0400] "CONNECT 66.60.157.247:25 HTTP/1.0" 404 207
    66.60.157.246 - - [29/Jul/2002:08:33:40 -0400] "CONNECT 66.60.157.247:25 HTTP/1.0" 404 207
    [Both of these machines {segfault,coredump}.monkeys.com are running
    Postfix SMTP servers and Apache Unix HTTP servers.]

    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management
    and tracking system please see: http://aris.securityfocus.com