Re: Port 10099?

> This morning a received a substantial batch of pump'n'dump scam spams
> from a variety of what I presumed were open proxies. However, most of
> them didn't seem to have any open proxies there. One thing that appeared
> very commonly though was an open port 10099, though it consistently
> refuses proxy connections:
>
> ..
> Any idea what this might be?


This has been going on for a couple of weeks. about 5% of all spam
sources has this port and 0% is an open proxy (tested a few K).

There is more going on, have a look at http://www.fi.uu.nl/~ftu/score.gif
this shows the percentage of open proxies found by my scanner over
the last 500 days. Notice the sharp drop that occurred a few weeks
ago.

We now see what we always knew would happen, the other side either
uses some sort of ACL, or they infect the victim with custom SW
rather than vanilla socks proxies.

> Perhaps the spammers have discovered port knocking?

I don't know. I am playing with honeypots & infecting a test
system with recent virusses to see what happend, but I have not
found anything yet.

Maybe one of the ISP's on this list can shed some light on this,
I am sure some of you have interesting trojans on your network.

----------------------------------------------
This message was sent to the opt-in DSBL list.
If you do not want to receive DSBL messages,
please send mail to [email protected].