[Dshield] Scans on ports 3128 & 8080 & 80
Jon R. Kibler
Jon.Kibler at aset.com
Fri May 24 20:06:31 GMT 2002
We have gotten hit a bunch of times today from HINET.NET users scanning on ports 3128, 8080, and 80. Our honey pot on those ports all capture the same identical "query"...
GET http://www.yahoo.com/ HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 4.01; Windows 95)
Can someone please explain exactly what the scanner is trying to accomplish? Any enlightenment would be GREATLY appreciated.
More information about the list