Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So at my business our receipt printer randomly printed some questionable looking data.

I looked into and it's clearly not something legitimate.

Can anyone give me a better idea of what's happening here?

1 HTTP/1.0
Content-Type: text/html
Proxy-Connection: keep-alive
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/, application/, application/msword, application/x-shockwave-flash */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; KuKu 0.65)
Authorization: Basic 0g==

All but one computer in the network are machines running OS:X - 1 Windows XP machine.

Customers sometimes connect to the network when they visit, so this might be such a situation.

What should be my next step?

Thanks so much!

share|improve this question
Did you miss a step here? How did you get from "my printer did something weird", to – Polynomial Jul 21 '13 at 16:28
Wait, you allow customers to connect to the internet from your business computer? – Casey Jul 21 '13 at 16:35
Allow me to clarify. Customers have their own 'guest' network they connect to. I didn't skip a step - the above is what the printer printed out. – Joe Jul 21 '13 at 16:52
Open proxy probing? That would be pretty random and on all your public IPs. One of these proxy scanners found your printer's IP, that would be my guess. What's its IP doing outside your firewall? – TildalWave Jul 21 '13 at 17:05
Your guess is as good as mine. its just a basic printer setup, it was not intentionally outside the network. – Joe Jul 21 '13 at 18:42
up vote 7 down vote accepted

Anyone able to use your printer is a vulnerability. This is a resource that should not be exposed to public networks. I suspect that "" is well... scanning for proxies. Its likely that they connected to an open port and tried to proxy a GET request for, but instead this was interpreted as data to be printed.

Conduct a full port scan (0-65535) of your network range from an external node. Close any unnecessary ports.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.