Re: patternmatch for scan

[rb.maillists () ns sympatico ca (Rick Ballard)]

> Is anyone familiar with an attack or probe which begins or ends with scanning
> only ports 3128 & 8080 on a target box? I've been seeing alot of this lately in
> various places.

This is generally from the RingZero trojan. The source hosts are trojanned 
victims that send the results of their scans to a central site.

See:
        http://www.sans.org/newlook/resources/ringzero.htm

--
Rick Ballard
Halifax, Nova Scotia, Canada