[Dshield] Open proxy servers again on the rise.

Doug White doug at clickdoug.com
Wed Aug 20 19:54:22 GMT 2003

Same here - The floodgates are opening.

Stop spam on your domain, use our gateway!
For hosting solutions http://www.clickdoug.com
ISP rated: http://www.forta.com/cf/isp/isp.cfm?isp_id=772
If you are not satisfied with my service, my job isn't done!

----- Original Message ----- 
From: "Jon R. Kibler" <Jon.Kibler at aset.com>
To: <list at dshield.org>
Sent: Wednesday, August 20, 2003 2:15 PM
Subject: [Dshield] Open proxy servers again on the rise.

| Greetings:
| Well, after about a week where the number of new open proxy servers had
monumentally decreased, it appears that the number of systems with newly
installed open proxy servers is again on the rise.
| Beginning last night, we started finding about 20 new IPs per hour with new
open proxy servers, and that trend has held all day -- more or less. Although
this is considerably less than we were seeing 2 or 3 weeks ago (when it was
averaging about 50 to 60 IPs per hour), it is about 10 to 20 times the number we
have been seeing for the last week or so.
| However, the amount of spam attempts has NOT increased again, at least not
yet. Most of what we are now seeing are port scans of our actual MTAs. We have
not seen any indication that scanning of our IPs without MTAs has increased.
| I guess new spam floods are probably on the way sometime soon. We find that it
is typically 24 to 36 hours from port scan to spam attempt -- if the proxy
server manages to live that long!
| Has anyone else noticed similar trends?
| Jon R. Kibler
| A.S.E.T., Inc.
| Charleston, SC  USA
| _______________________________________________
| list mailing list
| list at dshield.org
| To change your subscription options (or unsubscribe), see:

More information about the list mailing list