[Snort-users] Scan Proxy

Cedric mailing-lists at ...134...
Tue Apr 24 11:26:10 EDT 2001


Hello A.L.Lambert,

>> > > I have been getting lots of SCAN Proxy Attempts lately to
>> > > ports 1080 8080 and 3128. 
>> > 
>> > I bet you a dollar you use IRC and the servers are scanning you.
>> > -Steve
>> 
>> Well if it was the case I would be very happy to send you a dollar.
>> But the real asnwer is no I do not even use icq so ?

ALL>         FYI - over the last 2 weeks, I've been seeing the same scans in
ALL> HUGE numbers (outpacing ftpd and bind scans sometimes for days on end).  
ALL> Probably a new worm or some such we'll hear about once someone figures out
ALL> what's going on.  :)

These are scans to find proxies and open socks proxies.
Hacker just go thru them to anonymize part of their activity.

Scanning for open porxies is an everyday's hacker job.






More information about the Snort-users mailing list