[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-relays] privoxy, port 8118 scans



Hey

I am wondering if this is a coincidence but since I started the tor relay, I see a lot of TCP/8118 connections attempts on my relay's external IP.

I run the offending source IPs (aggregated to /24s) through cymru's ip-to-asn decoder and here are results of only today:


Bulk mode; whois.cymru.com [2014-01-19 15:16:19 +0000]
15003   | 108.177.181.0    | 108.177.180.0/22    | US | arin     | 2012-03-15 | NOBIS-TECH - Nobis Technology Group, LLC
15003   | 142.91.245.0     | 142.91.240.0/21     | US | arin     | 2012-06-08 | NOBIS-TECH - Nobis Technology Group, LLC
15003   | 172.240.255.0    | 172.240.0.0/16      | US | arin     | 2013-04-08 | NOBIS-TECH - Nobis Technology Group, LLC
15003   | 173.208.16.0     | 173.208.16.0/21     | US | arin     | 2009-12-17 | NOBIS-TECH - Nobis Technology Group, LLC
15003   | 173.208.57.0     | 173.208.56.0/22     | US | arin     | 2009-12-17 | NOBIS-TECH - Nobis Technology Group, LLC
15003   | 173.208.85.0     | 173.208.80.0/21     | US | arin     | 2009-12-17 | NOBIS-TECH - Nobis Technology Group, LLC
15003   | 173.234.12.0     | 173.234.12.0/22     | US | arin     | 2010-02-12 | NOBIS-TECH - Nobis Technology Group, LLC
15003   | 173.234.153.0    | 173.234.152.0/22    | US | arin     | 2010-02-12 | NOBIS-TECH - Nobis Technology Group, LLC
15003   | 173.234.235.0    | 173.234.232.0/22    | US | arin     | 2010-02-12 | NOBIS-TECH - Nobis Technology Group, LLC
15003   | 173.234.247.0    | 173.234.244.0/22    | US | arin     | 2010-02-12 | NOBIS-TECH - Nobis Technology Group, LLC
15003   | 173.234.33.0     | 173.234.32.0/22     | US | arin     | 2010-02-12 | NOBIS-TECH - Nobis Technology Group, LLC
15003   | 173.234.41.0     | 173.234.40.0/22     | US | arin     | 2010-02-12 | NOBIS-TECH - Nobis Technology Group, LLC
15003   | 173.234.60.0     | 173.234.56.0/21     | US | arin     | 2010-02-12 | NOBIS-TECH - Nobis Technology Group, LLC
15003   | 23.19.130.0      | 23.19.128.0/22      | US | arin     | 2011-04-25 | NOBIS-TECH - Nobis Technology Group, LLC
15003   | 23.19.50.0       | 23.19.50.0/23       | US | arin     | 2011-04-25 | NOBIS-TECH - Nobis Technology Group, LLC
15003   | 23.19.54.0       | 23.19.52.0/22       | US | arin     | 2011-04-25 | NOBIS-TECH - Nobis Technology Group, LLC
15003   | 23.19.67.0       | 23.19.64.0/20       | US | arin     | 2011-04-25 | NOBIS-TECH - Nobis Technology Group, LLC
15003   | 23.19.75.0       | 23.19.64.0/20       | US | arin     | 2011-04-25 | NOBIS-TECH - Nobis Technology Group, LLC
15003   | 23.19.89.0       | 23.19.88.0/21       | US | arin     | 2011-04-25 | NOBIS-TECH - Nobis Technology Group, LLC
15003   | 70.32.43.0       | 70.32.43.0/24       | US | arin     | 2008-07-25 | NOBIS-TECH - Nobis Technology Group, LLC
18450   | 173.231.54.0     | 173.231.0.0/18      | US | arin     | 2010-03-19 | WEBNX - WebNX, Inc.
20248   | 74.82.191.0      | 74.82.176.0/20      | US | arin     | 2010-01-26 | TAKE2 - Take 2 Hosting, Inc.
40676   | 216.24.204.0     | 216.24.192.0/20     | US | arin     | 2010-10-14 | AS40676 - Psychz Networks
46475   | 192.169.84.0     | 192.169.80.0/20     | US | arin     | 2012-11-02 | LIMESTONENETWORKS - Limestone Networks, Inc.
46475   | 192.169.86.0     | 192.169.80.0/20     | US | arin     | 2012-11-02 | LIMESTONENETWORKS - Limestone Networks, Inc.
46475   | 208.115.203.0    | 208.115.192.0/18    | US | arin     | 2010-01-06 | LIMESTONENETWORKS - Limestone Networks, Inc.
46475   | 208.115.228.0    | 208.115.192.0/18    | US | arin     | 2010-01-06 | LIMESTONENETWORKS - Limestone Networks, Inc.
46475   | 216.245.222.0    | 216.245.192.0/19    | US | arin     | 2008-01-28 | LIMESTONENETWORKS - Limestone Networks, Inc.
46475   | 63.143.33.0      | 63.143.32.0/19      | US | arin     | 2011-10-27 | LIMESTONENETWORKS - Limestone Networks, Inc.
46475   | 63.143.36.0      | 63.143.32.0/19      | US | arin     | 2011-10-27 | LIMESTONENETWORKS - Limestone Networks, Inc.
46475   | 63.143.52.0      | 63.143.32.0/19      | US | arin     | 2011-10-27 | LIMESTONENETWORKS - Limestone Networks, Inc.
46475   | 64.31.43.0       | 64.31.0.0/18        | US | arin     | 2010-12-27 | LIMESTONENETWORKS - Limestone Networks, Inc.
46475   | 69.162.116.0     | 69.162.64.0/18      | US | arin     | 2008-06-27 | LIMESTONENETWORKS - Limestone Networks, Inc.
46475   | 69.162.74.0      | 69.162.64.0/18      | US | arin     | 2008-06-27 | LIMESTONENETWORKS - Limestone Networks, Inc.
46475   | 74.63.226.0      | 74.63.192.0/18      | US | arin     | 2008-08-29 | LIMESTONENETWORKS - Limestone Networks, Inc.
46475   | 74.63.249.0      | 74.63.192.0/18      | US | arin     | 2008-08-29 | LIMESTONENETWORKS - Limestone Networks, Inc.

There were almost 200k SYN packets sent for the last 15h from the 228 unique IP addresses.

Would that be part of tor project?
I have never run privoxy on my network and I am not really sure what the relation between tor and privoxy is?
Can somebody shine some light on that?



[0] https://www.team-cymru.org/Services/ip-to-asn.html

Thanks,
-mateusz

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail

_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays