lifebsideben

prince.org has been getting a ton of proxy-probing attacks lately… I see in the logs TONS of “CONNECT :25″ requests, ie trying to ping a remote SMTP server through prince.org as a web proxy. Now, mind you, prince.org doesn’t have a proxy enabled… so… you figure it out. Script kiddies, go away. Too bad it’s coming from a rather large number of IPs, or I’d just blacklist them. At least some are resolving back to Taiwan. Annoying…

Ah, there IS a way (after much futzing) to block CONNECTs explicitly. Done!

Tags: princeorg, security