Due to botnet attacks which mostly use open or unsecure proxy servers we are performing several counter measurements to protect both the network and its users from those annoying attacks.

Measurements:

Active proxy scanner:

We are running pxys2 proxy scanner which scans for the following proxies:

• insecure WinGate
• Socks v4 and v5
• HTTP proxies on several ports

DNS blacklists:

We are using blacklists to find and gline IPs which are known for proxies or for being part of the Tor network. We are still experimenting with those lists.

Currently we use:

What do I have to do if I am glined?

Gline Reason is: AUTO PXYS GLine -- [*]:

If you are using a proxy:

• Stop using a proxy and connect directly instead

If you have to use a proxy or are yourself admin of the proxy:

• Ask the proxy admin to configure it securely
• After this was done, visit Gline check and request to be unglined, stating your Proxy was secured

Gline Reason is: AUTO Busted by the exitnodes.tor.dnsbl.sectoor.de DNSBL!:

• visit the sectoor homepage
• hit "check my ip"
• send them a mail to request to be delisted (mailaddress is displayed on match)
• some hours after delistind also the gline will be removed.
• You do NOT need to request an ungline. Unglines are not done, because glines are reissued automatically as long as the ip is listed.

Gline Reason is: AUTO Busted by the *.dnsbl.sorbs.net DNSBL!:

• visit the SORBS homepage
• contact them using their support system (linked there)
• some hours after delisting also the gline will be removed.
• You do NOT need to request an ungline. Unglines are not done, because glines are reissued automatically as long as the ip is listed.

Gline Reason is: AUTO Busted by the tor.dan.me.uk DNSBL!:

• Stop using tor. If you never used tor, wait a bit, the one using your ip before (<1 hour) used tor. The ip will be delisted automatically after less than 1 hour.
• You do NOT need to request an ungline. Unglines are not done, because glines are reissued automatically as long as the ip is listed.