Gamers-IRC Network Open Proxy Scanners
|
Hey! What gives?!?! I am being port scanned by:
192.148.174.13 (irc.frws.com) or 192.148.174.35 (proxyscan.frws.com)
Protected by BOPM and the following DNSBL List(s):
Well - you or someone at your location uses Gamers-IRC to chat on.
It's that simple! The rest we try to explain below, read on!
From the Gamers-IRC Public Policy:
"Connecting to Gamers-IRC Network will subject you to a legal, open Proxy scan.
Pursuant to United States Code (U.S.C.), Title 18, Part 1, Section 2701 Part(c) - we reserve the right to scan your system to ensure that your connection does not provide a network or security risk to us, our servers, or our users.
All users connecting on un-secure proxy hosts shall be banned from the network."
[GENERAL]
1) What is an Open Proxy?
2) Why does Gamers-IRC not allow them?
3) What types of proxies are you scanning for?
4) What is the address of the server doing the scanning?
5) I was blocked by the BOPM or ORDB DNSBL Lists - what are these?
[AFTER THE FACT]
1) I got Klined - how long am I banned for if I fix the open proxy?
2) I have been on Gamers-IRC for YEARS and now I am banned, WHY?
3) Will you help me secure my proxy, I have no clue how to fix it?
4) I am not running any proxy software and got banned!?!
[CONTACT]
for Kline and Proxy Information.
/join #irc-help on irc.gamers-irc.org, port 6667 - to discuss Proxies and solutions.
Contact the manufacturer of the proxy software and/or equipment in use.
[GENERAL]
1) What is an Open Proxy?
Open proxies take many forms, but for our purposes an Open Proxy is a computer that has the ability to act as a bouncer or forwarder for just about anyone's connection on the Internet. This could be your Wingate software that was not properly installed or configured, a SQUID server used to quickly grab web pages but left very open to the public - or your Cisco DSL/Cable router with port 23 left opened and the default password still in place.
There are many types of proxies out there, the best thing is for you to consult the documentation and make your equipment as safe and secure as possible. A closed proxy is allowed - indeed we will not even know you are running one if it is properly secured.
In a nutshell - Open proxies allow people to harass users and staff, avoid channel and network bans, flood the network and even SPAM people with email.
2) Why does Gamers-IRC not allow them?
See above! Due to the rampant abuse of these Open proxies - most all major IRC networks, including Gamers-IRC, have implemented Network Wide Open Proxy scanning upon connection to the network. This was primarily due to people using these proxies to flood channels and the network, avoid channel and network bans, spread dangerous trojans and viruses - and generally harass users and staff. There is absolutely no reason to have a proxy that is open to the public on today's Internet - and most are just mis-configured servers and clients that are just ripe for abuse.
If you have and/or use a proxy - please secure it.
By implementing the scanning of users on connection and banning open proxies we can keep these open proxies off the network, making Gamers-IRC a more enjoyable and safer place to chat.
3) What types of proxies are you scanning for?
Currently, the scanning server is scanning for:
Open Wingate Proxies on Port 1080
Open Socks 4 and 5 Proxies also on Port 1080
Open Squid and HTTP Proxies on Ports 80, 3128, 8080, and 8081
Open Cisco Routers on Port 23, using default passwords
In the future we may also scan for:
Port 8000, 8001, 9000, 6588 and any others we feel pose a threat
4) What are the addresses of the servers doing the scanning?
192.148.174.13
irc.frws.com
Or alternatively:
192.148.174.35
proxyscan.frws.com
Any and all of the linked Gamers-IRC Servers can also scan you.
See the network /motd for these servers and their addresses.
In the future, more scanning servers may be placed online and their addresses posted here.
5) I was blocked by the DNSBL Lists - what are these?
DNSBL's are block (or black) lists used to deny service to IP addresses and hosts that appear on the
lists. At Gamers-IRC IRC they use 1 or more DNSBL's:
Currently, Gamers-IRC uses BOPM.SBG-RBL.ORG, which has a list geared towards IRC and contains Open Proxies that have been used on this and other networks.
Gamers-IRC also uses the http://dnsbl.dronebl.org and exitnodes.tor.dnsbl.sectoor.de - both DNSBLs are set to block on abusive hosts and Torrent endpoints.
If you are blocked by a DNSBL, you need to go to their site after you have secured your proxy and apply to be removed. We cannot and will not do this for you.
Practice Safe Internet Etiquette - secure your proxy and do not use open proxies, simple as that!
In the future, more lists may be added if its deemed in the best interests of Gamers-IRC to do so.
[AFTER THE FACT]
1) I got Klined - how long am I banned for if I fix the open proxy?
Bans are currently for 30-60 minutes when an Open Proxy is detected. Continued connection attempts without securing the proxy could result in longer bans, and possibly a permanent ban from the network. Please secure your proxy!
2) I have been on Gamers-IRC for YEARS and now I am banned, WHY?
We hope you have read all of the above...
There are many reasons for this scanning to be implemented - and you really should secure your proxy if you have the need to use one. In the past we have only scanned particular channels for Open Proxies - so if you had never joined one, well, you were safe. Now it is not permissible to use an Open Proxy anywhere on the network - you are welcome to return once you have secured your proxy.
3) Will you help me secure my proxy, I have no clue how to fix it?
There are FAR too many proxy applications out there for us to provide any valuable individual assistance.
Feel free to join #irc-help and ask if anyone is available to assist you, and if someone is available and knows how to secure you particular piece of hardware/software, they will gladly assist you.
The best course of action is to *Please* read your manual, consult the manufacturers website and secure the proxy so that only people inside your network can use it.
In the case of a Cisco ADSL/Cable router - change the default password and block port 23 from anywhere outside your network.
And as we have said: RTFM - Read The Funny Manual that came with the proxy software or hardware.
4) I am not running any proxy software and got banned!?!
You were probably caught by the Default Cisco Password check. If you are running a Cisco DSL or Cable router/modem and have not changed the default password or blocked port 23 - then please do so. That should solve the problem.
If you are not using a Cisco and got banned, and are not running a proxy (to your knowledge) - then have your system checked for viruses/trojans and possible hacking activity - the Scanner detected a proxy or exploitable system at your location and will not let you use the network until you secure it.
|
|
