Re: Port 10099?

Paul Howarth wrote:
> This morning a received a substantial batch of pump'n'dump scam spams 
> from a variety of what I presumed were open proxies. However, most of 
> them didn't seem to have any open proxies there. One thing that appeared 
> very commonly though was an open port 10099, though it consistently 
> refuses proxy connections:


> Any idea what this might be?
> 
> Perhaps the spammers have discovered port knocking?

They do since a log time, AFAIK.
I've observed plenty of machines with open ports 7xxx and 9xxx (always
with B-A = 2000 ) that do present a proxy port opened only during the
real spam run.
I guessed the two ports are serving some kind of auth stuff.

Know anything about these too?

-- 
Balla Emanuele            [email protected]
Spin InterNetWorking      http://www.spin.it
Via del Follatoio, 12     Phone: +39-40-9869090
I-34148 Trieste - Italy   Fax  : +39-40-8992286

----------------------------------------------
This message was sent to the opt-in DSBL list.
If you do not want to receive DSBL messages,
please send mail to [email protected].