Security Incidents mailing list archives

Re: Strange Scan

From: Glenn Williamson <dubz () PROGSOC UTS EDU AU>
Date: Mon, 18 Dec 2000 13:03:24 +1100

Found this one in some logs today. Ftp server running on port 21

[2] Sun 17Dec00 08:56:24 - (000042) GET http://www.s3.com HTTP/1.1


<snip>

[2] Sun 17Dec00 08:56:24 - (000042) User-Agent: ProxyHunter


Proxy Hunter is a little utility I used to use to find anonymous proxies
(i.e. people that have set up WinProxy poorly). All it does is scan a range
of IP's and attempt to retrieve a web page.

Only the great man in the sky knows why this idiot is using port 21.

And dont worry about http://www.s3.com, it just happens to be the default
page that Proxy Hunter attempts to retrieve.

   gleNN

Current thread:

could be slice? Andrita Constantin (Dec 12)
- Re: could be slice? Guilherme Mesquita (Dec 17)
  - Re: could be slice? Ryan Sweat (Dec 17)
    - Strange Scan TJ Jablonowski (Dec 18)
    - Re: Strange Scan Glenn Williamson (Dec 18)
    - Re: Strange Scan geoff (Dec 18)