[squid-users] scanning through proxy

Hi All,

We notice there is a surge in port 80 scanning through proxy servers in
the past few days. As these requests come from many valid source ips to
random destination ips, it is quite impossible to deny based on ip.

Below is a sample of the scan request.

  GET / HTTP/1.1
  Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
  User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
  Host: 61.199.26.41
  Connection: Keep-Alive

In order to prevent the proxy servers being 'blacklisted', is there anyway
to deny such request?

Thanks,
Wei Keong
Received on Thu Nov 13 2003 - 01:21:14 MST