Re: Proxy can pass thru scanner

Erik Fears <[email protected]> Sun, 19 Mar 2006 14:01:34 -0800
Newsgroups gmane.network.irc.bopm
Message-ID <[email protected]>
> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:80 (HTTP) [default] (0 bytes read)
> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:8080 (HTTP) [default] (0 bytes read)
> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:6588 (HTTP) [default] (0 bytes read)
> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:1080 (SOCKS4) [default] (0 bytes read)
> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:1080 (SOCKS5) [default] (0 bytes read)
> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:23 (ROUTER) [default] (0 bytes read)
> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:23 (WINGATE) [default] (0 bytes read)
> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:3128 (HTTP) [default] (1001 bytes read)
> [Mar 19 19:02:59 2006] SCAN -> Negotiation failed 212.44.131.7:80 (HTTPPOST) [default] (0 bytes read)
> [Mar 19 19:02:59 2006] SCAN -> Scan 212.44.131.7 [default] completed
> 
> But, this host(nevamx.sovintel.ru) HAS public open proxy on port 3128.
> How i can block this kind of proxies?...
> 

looks like the host has multiple A recods...

nevamx.sovintel.ru has address 212.44.131.7
nevamx.sovintel.ru has address 213.221.51.210
nevamx.sovintel.ru has address 213.221.51.214
nevamx.sovintel.ru has address 213.221.51.218
nevamx.sovintel.ru has address 213.221.51.222
nevamx.sovintel.ru has address 213.221.54.130
nevamx.sovintel.ru has address 213.221.54.134
nevamx.sovintel.ru has address 213.221.54.138
nevamx.sovintel.ru has address 213.221.54.142