RE: patternmatch for scan

From: Martin Machacek (mmat_private)
Date: Wed Feb 23 2000 - 00:33:19 PST

Next message: Marcus J. Ranum: "Administrivia"

Previous message: Darren Reed: "Re: the expensive way to do DDoS ?"
Maybe in reply to: Kenneth_W_Foxat_private: "patternmatch for scan"
Next in thread: Robert Graham: "Re: patternmatch for scan"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On 19-Feb-00 Kenneth_W_Foxat_private wrote:
> Is anyone familiar with an attack or probe which begins or ends with scanning
> only ports 3128 & 8080 on a target box? I've been seeing alot of this lately
> in various places.

Yes, somebody is searching for open HTTP proxy. 3128 is default port for Squid
and 8080 is frequently used port for HTTP proxies.

        Martin 

---
[PGP KeyID F3F409C4]

Next message: Marcus J. Ranum: "Administrivia"
Previous message: Darren Reed: "Re: the expensive way to do DDoS ?"
Maybe in reply to: Kenneth_W_Foxat_private: "patternmatch for scan"
Next in thread: Robert Graham: "Re: patternmatch for scan"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:07:18 PDT