Re: R: correlation between porscans and local activity

[mikebabcock () POBOX COM (Michael Babcock)]

Actually, DAL.NET IRC servers (at least) scan connectees for 1080 among other ports to make sure they aren't vulnerable 
to attack.  This type of pro-active scanning is a Good Thing (TM) and should be encouraged IMHO.

<FONT COLOR="#222255">> There now appears to be some coincidence between the times my family</FONT>
<FONT COLOR="#222255">> does web browsing and when I get scanned for port 1080.</FONT>

Someone is probably trying to understand wether or not your is an open SOCKS
firewall they can use. I could bet these scans occur during IRC sessions
from one of your windows boxes (check if in the logs you have outgoing
traffic towards a 666X port).

Scanning IPs on IRC channels to check for open SOCKS it's a rather common
thing hackers-wanna-be love to do, since it leads to huge lists of addresses
they can trade, share and sell to other script kiddies around.

Just my bit of info,
Raist