Proxy information
cz  de  en  es  fr  hu  it  nl  pl  pt  rs  sk  tr 

Due to botnet attacks which mostly use open or unsecure proxy servers we are performing several counter measurements to protect both the network and its users from those annoying attacks.

Measurements:

Active proxy scanner:

We are running pxys2 proxy scanner which scans for the following proxies:

  • insecure WinGate
  • Socks v4 and v5
  • HTTP proxies on several ports

DNS blacklists:

We are using blacklists to find and gline IPs which are known for proxies or for being part of the Tor network. We are still experimenting with those lists.

Currently we use:

DNS blacklist short description url
exitnodes.tor.dnsbl.sectoor.de A list containing clients where Tor runs on. homepage
http.dnsbl.sorbs.net A List of Open HTTP Proxy Servers. homepage
socks.dnsbl.sorbs.net List of Open SOCKS Proxy Servers. homepage
misc.dnsbl.sorbs.net List of open Proxy Servers not listed in the SOCKS or HTTP lists. homepage
torexit.dan.me.uk A list of tor nodes online in the tor network. This list is updated hourly with the tor network. homepage

What do I have to do if I am glined?

Gline Reason is: AUTO PXYS GLine -- [*]:

If you are using a proxy:

  • Stop using a proxy and connect directly instead

If you have to use a proxy or are yourself admin of the proxy:

  • Ask the proxy admin to configure it securely
  • After this was done, visit Gline check and request to be unglined, stating your Proxy was secured

Gline Reason is: AUTO Busted by the exitnodes.tor.dnsbl.sectoor.de DNSBL!:

  • visit the sectoor homepage
  • hit "check my ip"
  • send them a mail to request to be delisted (mailaddress is displayed on match)
  • some hours after delistind also the gline will be removed.
  • You do NOT need to request an ungline. Unglines are not done, because glines are reissued automatically as long as the ip is listed.

Gline Reason is: AUTO Busted by the *.dnsbl.sorbs.net DNSBL!:

  • visit the SORBS homepage
  • contact them using their support system (linked there)
  • some hours after delisting also the gline will be removed.
  • You do NOT need to request an ungline. Unglines are not done, because glines are reissued automatically as long as the ip is listed.

Gline Reason is: AUTO Busted by the tor.dan.me.uk DNSBL!:

  • Stop using tor. If you never used tor, wait a bit, the one using your ip before (<1 hour) used tor. The ip will be delisted automatically after less than 1 hour.
  • You do NOT need to request an ungline. Unglines are not done, because glines are reissued automatically as long as the ip is listed.