[Dshield] Scans on ports 3128 & 8080 & 80

Jon R. Kibler Jon.Kibler at aset.com
Fri May 24 20:06:31 GMT 2002

We have gotten hit a bunch of times today from HINET.NET users scanning on ports 3128, 8080, and 80. Our honey pot on those ports all capture the same identical "query"...

GET http://www.yahoo.com/ HTTP/1.1

Host: www.yahoo.com

Accept: */*

Pragma: no-cache

User-Agent: Mozilla/4.0 (compatible; MSIE 4.01; Windows 95)

Can someone please explain exactly what the scanner is trying to accomplish? Any enlightenment would be GREATLY appreciated.

Jon Kibler

More information about the list mailing list