Re: Proxy can pass thru scanner
Erik Fears <[email protected]> Sun, 19 Mar 2006 14:01:34 -0800
| Newsgroups | gmane.network.irc.bopm |
|---|---|
| Message-ID | <[email protected]> |
> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:80 (HTTP) [default] (0 bytes read) > [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:8080 (HTTP) [default] (0 bytes read) > [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:6588 (HTTP) [default] (0 bytes read) > [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:1080 (SOCKS4) [default] (0 bytes read) > [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:1080 (SOCKS5) [default] (0 bytes read) > [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:23 (ROUTER) [default] (0 bytes read) > [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:23 (WINGATE) [default] (0 bytes read) > [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:3128 (HTTP) [default] (1001 bytes read) > [Mar 19 19:02:59 2006] SCAN -> Negotiation failed 212.44.131.7:80 (HTTPPOST) [default] (0 bytes read) > [Mar 19 19:02:59 2006] SCAN -> Scan 212.44.131.7 [default] completed > > But, this host(nevamx.sovintel.ru) HAS public open proxy on port 3128. > How i can block this kind of proxies?... > looks like the host has multiple A recods... nevamx.sovintel.ru has address 212.44.131.7 nevamx.sovintel.ru has address 213.221.51.210 nevamx.sovintel.ru has address 213.221.51.214 nevamx.sovintel.ru has address 213.221.51.218 nevamx.sovintel.ru has address 213.221.51.222 nevamx.sovintel.ru has address 213.221.54.130 nevamx.sovintel.ru has address 213.221.54.134 nevamx.sovintel.ru has address 213.221.54.138 nevamx.sovintel.ru has address 213.221.54.142