Re: Proxy can pass thru scanner

Hm,
1) if there is multiply A records it become impossible to detect proxy?
2) in this log scanner is scanning some IP, not host.

>> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:80 (HTTP) [default] (0 bytes read)
>> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:8080 (HTTP) [default] (0 bytes read)
>> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:6588 (HTTP) [default] (0 bytes read)
>> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:1080 (SOCKS4) [default] (0 bytes read)
>> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:1080 (SOCKS5) [default] (0 bytes read)
>> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:23 (ROUTER) [default] (0 bytes read)
>> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:23 (WINGATE) [default] (0 bytes read)
>> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:3128 (HTTP) [default] (1001 bytes read)
>> [Mar 19 19:02:59 2006] SCAN -> Negotiation failed 212.44.131.7:80 (HTTPPOST) [default] (0 bytes read)
>> [Mar 19 19:02:59 2006] SCAN -> Scan 212.44.131.7 [default] completed
>>
>> But, this host(nevamx.sovintel.ru) HAS public open proxy on port 3128.
>> How i can block this kind of proxies?...
>>
>
> looks like the host has multiple A recods...
>
> nevamx.sovintel.ru has address 212.44.131.7
> nevamx.sovintel.ru has address 213.221.51.210
> nevamx.sovintel.ru has address 213.221.51.214
> nevamx.sovintel.ru has address 213.221.51.218
> nevamx.sovintel.ru has address 213.221.51.222
> nevamx.sovintel.ru has address 213.221.54.130
> nevamx.sovintel.ru has address 213.221.54.134
> nevamx.sovintel.ru has address 213.221.54.138
> nevamx.sovintel.ru has address 213.221.54.142
>
>


-- 
Best regards,
Alexey