Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

<embarrassing>
I recently put up a proxy (squid) on a personal server, made the noobish mistake of not removing the access-all group I put in whilst testing, and came back a few days later to find a reasonable (several GB per day) amount of traffic to a whole stack of IP's running through my server.
</embarrassing>

Access issue resolved, but I'm a little puzzled as to how the service was dispersed to so many different users?

I gather some spider happened across the open port, but do those websites that provide "anonymous proxies" just crawl the net for available services all day or what?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Those types of services just scan entire network ranges for common proxy ports. Once they find one, they test to make sure it's actually "open", and post it to the site.

I'm not sure how intelligent the bots are, but they may scan known "service provider" networks more often then your random home IP.

share|improve this answer
    
That sounds about right, and it would definitly make sence to ident and hit more active hosting subnets more often. Most of the hits are now coming from 88.80.10.1, requesting spam-chaos.com/pp/set-cookie.php. –  Kyle May 13 '11 at 6:19

Proxy Leeching is a big business. Hackers use scripts to scan for proxies then compile a list and sell them on hacking/warez/pirating sites. Most of the people using proxies are up to no good and are trying to hide their tracks.

share|improve this answer
    
The majority of hits when the proxy was open were from a single ip in some tiny little country (cant remember where), remainder where from all over and appeared to be mostly normal browsing activities. –  Kyle May 13 '11 at 6:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.