Re: Proxy can pass thru scanner

> Hm,
> 1) if there is multiply A records it become impossible to detect proxy?
> 2) in this log scanner is scanning some IP, not host.
> 
> >> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:80 (HTTP) [default] (0 bytes read)
> >> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:8080 (HTTP) [default] (0 bytes read)
> >> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:6588 (HTTP) [default] (0 bytes read)
> >> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:1080 (SOCKS4) [default] (0 bytes read)
> >> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:1080 (SOCKS5) [default] (0 bytes read)
> >> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:23 (ROUTER) [default] (0 bytes read)
> >> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:23 (WINGATE) [default] (0 bytes read)
> >> [Mar 19 19:02:56 2006] SCAN -> Negotiation failed 212.44.131.7:3128 (HTTP) [default] (1001 bytes read)
> >> [Mar 19 19:02:59 2006] SCAN -> Negotiation failed 212.44.131.7:80 (HTTPPOST) [default] (0 bytes read)
> >> [Mar 19 19:02:59 2006] SCAN -> Scan 212.44.131.7 [default] completed
> >>
> >> But, this host(nevamx.sovintel.ru) HAS public open proxy on port 3128.
> >> How i can block this kind of proxies?...
> >>
> >
> > looks like the host has multiple A recods...
> >
> > nevamx.sovintel.ru has address 212.44.131.7
> > nevamx.sovintel.ru has address 213.221.51.210
> > nevamx.sovintel.ru has address 213.221.51.214
> > nevamx.sovintel.ru has address 213.221.51.218
> > nevamx.sovintel.ru has address 213.221.51.222
> > nevamx.sovintel.ru has address 213.221.54.130
> > nevamx.sovintel.ru has address 213.221.54.134
> > nevamx.sovintel.ru has address 213.221.54.138
> > nevamx.sovintel.ru has address 213.221.54.142
> >
> >

Oops, don't know what I was thinking here. BOPM scans the IP given to it by the ircd. It's most likely that the output IP of this proxy is different than the IP used to access it.

-erik