RE: [plug] scanner/ probes

Wed, 25 Jul 2001 04:29:11 -0700

Title: Re: [plug] scanner/ probes
hmmm... how come these people are trying to access our server using port 80 and 21?
 
why is this weird? we don't use port 80 and 21. i was advised by pluggers to use ssh. and the servers which i found these ip are *supposed* to be inaccessible from the public. they can be accessed by the public but not with the ip address of the server since visiting our site means going to the US then the US server will get the webpages here locally. naka-proxy pass kasi yung websites namin. so i thought if someone probes our server locally then they have extracted the ip addresses of the servers through proxy pass.
 
 
      internet
           |
     US server
           |
         /   \
        /     \
server1     server2
 
 
how come these ips access server1 and server2 on the ports that we don't run? does this mean hackers are using pacific internet's proxy servers to hack?
 
please enlighten me. thanks.

Fritz Mesedilla
Systems Administrator

Summit Interactive, Inc.
FHM | Seventeen | Candy | Cosmopolitan | Preview | Good Housekeeping
femalenetwork.com | candymag.com | fhm.com.ph | cosmo.com.ph

Palm Pilot Software: TVSked - Download from the link below
----------------------------------------------------------------------------
http://mesedilla.tripod.com           +Basta Ikaw Lord

-----Original Message-----
From: Mike Maravillo [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, July 25, 2001 5:41 PM
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Subject: Re: [plug] scanner/ probes

On Wed, Jul 25, 2001 at 05:21:34PM +0800, Fritz Mesedilla wrote:
> there is this certain ip address that keeps on probing our server:
>
> 192.169.39.67
> 192.169.39.68
> 192.169.39.69
> 192.169.39.70
> 192.169.39.71
> 192.169.39.72
>
> is this person using a new scanner that spoofs the ip address?
>
> someone advised me never to retaliate on a scan. as i try to reverse scan i
> may probe an innocently compromised server.
>
> so what am i to do?

These IPs look like a farm of Squid proxy servers (port 8080)
from Pacific Internet.

--
 .--.  Michael J. Maravillo                   office://+63.2.894.3592/
( () ) Q Linux Solutions, Inc.              mobile://+63.917.897.0919/
 `--\\ A Philippine Open Source Solutions Co.  http://www.q-linux.com/
_
Philippine Linux Users Group. Web site and archives at http://plug.linux.org.ph
To leave: send "unsubscribe" in the body to [EMAIL PROTECTED]

To subscribe to the Linux Newbies' List: send "subscribe" in the body to [EMAIL PROTECTED]

Reply via email to