Too Busy For Words - the PaulWay Blog

I don't know, this might be old hat for all you dedicated SANS-watchers. But I just got a ping in my Apache logs for a very long DNS name ending with 'ii.9966.org'. The only thing I could find about it was on SANS but is still somewhat sketchy. AFAICS it's just a very fast parallel proxy server scanner. I wonder if my curiosity is endangering feline lives by having done a wget on the URL they were requesting...

From an nmap scan (which I seem to do by reflex on these dodgy requests) it has ssh, smtp, httpd, half of the NetBIOS ports, MySQL, Tomcat and what I think is the Squid proxy management port open. Good work, hackers of China!