Here is a quick example of a scan that we have been seeing a lot of lately, especially in our HoneyPoints deployed around consumer ISP networks. The example is about month old, but proxy scans are a very common occurrence.
HoneyPoint shows the following aler (some data modified for privacy)t:
XXX received an alert from 184.108.40.206 at 2008-11-08 09:57:07 on port 80
Alert Data: GET http://www.morgangirl.com/pics/land/land1.jpg HTTP/1.0
Now, the XXX replaces the HoneyPoint location, so it remains obscured from the public.
This is a web server emulating HoneyPoint and it is listening on port 80.
The Alert Data: field shows the request received, which appears to be a proxy attempt to get a graphic.
The source of the request was 220.127.116.11 which the whois plugin shows to be (trimmed):
% Information related to ‘18.104.22.168 – 22.214.171.124’
inetnum: 126.96.36.199 – 188.8.131.52
descr: ADDIO Ltd.
descr: Server farm Daype.com
status: ASSIGNED PA
source: RIPE # Filtered
org-name: Institute of Mathematics and Computer Science of University of Latvia
Interesting in that the agent is likely faked as webcollage, a screen saver type application for displaying random graphics from the web. Another possibility on this event is that a previous scanner took the bait of the 200 return code from the HoneyPoint and added it as an open proxy. If that is true, then we may be on a proxy list and get to see many requests from people attempting to use open proxies. Getting a HoneyPoint added into these lists has given us great insight to web attacks, scams and phishing attacks in the past.
Now you have a variety of actions, you could block the source IP address to kill further scans and probes from that host. You could report the suspicious activities to the ISP in question. If a review of the web site that was the target showed illicit activity, you could also analyze and proceed to take actions to alert its owners as well. Many times these quick investigations have identified compromised hosts on both ends or compromised web hosts that are spreading malware. Plugins are available or can be created to automate many, if not all of these activities.
In this case, since this is simply a quick proxy attempt, and a cursory review of the target web site does not show any overt malicious activity, we will pass on this one and just use it as an example.
HoneyPoint can be used in a variety ways. Internet exposed HoneyPoints can give you deep insights into the types of targeting and exploit activity your networks are experiencing without the need to troll through immense log files or dig through noisy NIDS event patterns. HoneyPoint is great at collecting black list hosts, scanners and bot patterns. The longer clients use HoneyPoint, the more they discover that they can do with it. It becomes like a security swiss army knife to many clients.