On Thu, 10 Apr 2008 07:30:36 MDT, James Lay said: > So yesterday a network that I do work for had it's mail server scanned. I > reported the scan (snort reported nmap -F scan) to the offending netblock > owner, thinking that they had a compromised machine. I was surprised to > receive an email this morning stating "Oh that's just our open proxy > scanner". Now....I've dealt with some open proxy scanners and seeing the > activity before, but GOOD GANDHI...they scanned the ENTIRE port range of the > machine..it took almost 3 hours from start to finish. Has anyone else seen > such aggressive "open proxy" scanning like that? OK, I'll bite - did they initiate the scan when your mailserver first tried to contact theirs, and greylist you until the scan finished, or were they idiots and accepted the mail before the scan finished, or are they complete and total bozos and they're trying to scan the entire Internet proactively?
Attachment:
pgpBA7cYsdwl5.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/