up vote 1 down vote favorite
share [g+] share [fb]

<embarrassing>
I recently put up a proxy (squid) on a personal server, made the noobish mistake of not removing the access-all group I put in whilst testing, and came back a few days later to find a reasonable (several GB per day) amount of traffic to a whole stack of IP's running through my server.
</embarrassing>

Access issue resolved, but I'm a little puzzled as to how the service was dispersed to so many different users?

I gather some spider happened across the open port, but do those websites that provide "anonymous proxies" just crawl the net for available services all day or what?

link|improve this question
feedback

2 Answers

up vote 2 down vote accepted

Those types of services just scan entire network ranges for common proxy ports. Once they find one, they test to make sure it's actually "open", and post it to the site.

I'm not sure how intelligent the bots are, but they may scan known "service provider" networks more often then your random home IP.

link|improve this answer
That sounds about right, and it would definitly make sence to ident and hit more active hosting subnets more often. Most of the hits are now coming from 88.80.10.1, requesting spam-chaos.com/pp/set-cookie.php. – Kyle May 13 '11 at 6:19
feedback
up vote 0 down vote

Proxy Leeching is a big business. Hackers use scripts to scan for proxies then compile a list and sell them on hacking/warez/pirating sites. Most of the people using proxies are up to no good and are trying to hide their tracks.

link|improve this answer
The majority of hits when the proxy was open were from a single ip in some tiny little country (cant remember where), remainder where from all over and appeared to be mostly normal browsing activities. – Kyle May 13 '11 at 6:23
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.