[Full-disclosure] Open proxy scanner experience

[Valdis.Kletnieks at vt.edu]

On Thu, 10 Apr 2008 07:30:36 MDT, James Lay said:

> So yesterday a network that I do work for had it's mail server scanned.  I
> reported the scan (snort reported nmap -F scan) to the offending netblock
> owner, thinking that they had a compromised machine.  I was surprised to
> receive an email this morning stating "Oh that's just our open proxy
> scanner".  Now....I've dealt with some open proxy scanners and seeing the
> activity before, but GOOD GANDHI...they scanned the ENTIRE port range of the
> machine..it took almost 3 hours from start to finish.  Has anyone else seen
> such aggressive "open proxy" scanning like that?

OK, I'll bite - did they initiate the scan when your mailserver first
tried to contact theirs, and greylist you until the scan finished, or were
they idiots and accepted the mail before the scan finished, or are they
complete and total bozos and they're trying to scan the entire Internet
proactively?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20080410/b7f3005e/attachment.bin