{Spam} Stop carders and idiots, 9K+ HTTP proxy IP's to block

[Bulworth]

Getting screwed by fraudulent transactions? Keep the bastards out of your site and stop them from placing their bogus orders in the first place.

We have a database of currently over 9,000 open HTTP proxies that scammers, crackers, carders, PW sharers, and other fucktards might be using to access, defraud, deface, and otherwise mess with your sites. Gain the advantage by locking out these proxies ahead of time before someone uses one of them to cost you money.

Code your signup scripts to check the surfer's REMOTE_ADDR against the IPs of these known proxies, then download and update the list whenever you want. You can even download the whole proxy list as a ready-to-use .htaccess file (not suggested for hightraffic sites, a 9000 line Limit directive is no good for server performance).

OpenProxies.com Only $20/month.

[nuclei]

heh or use em for other purposes

[pantymaniac]

normally there is around 50.000 mate

[Bulworth]

Originally posted by pantymaniac
normally there is around 50.000 mate

Show me a site with 50K verified open proxies - I ain't talking proxies from 6 months ago, or hosts that happen to be listening on a proxy port but aren't really proxies - and I'll show you my dick. OK, I won't really show my dick, since page-widening posts are generally considered rude.. ;)

Seriously though, I doubt there's any site out there with 50K proxies, not even the DNSBLs have that many listed (we feed into the Osirusoft DNSBL, btw).

There are some bullshitter sites like

a) tools.rosinstrument.com - OK, do you really trust a site whose scripts are so fucked up that they still report the current year as "103"? Y2K was 3 years ago. If they haven't fixed that yet, I wonder what else they haven't fixed... Like, oh, maybe, their proxy testing/scanning engine...

b) atomintersoft.com - they claim "422210 proxy servers in database" but you notice they don't bother to mention how many are open. There aren't 420K open proxies in the world right now, let alone in a single database. Try using 10 or so of the "proxies" listed at atomintersoft as proxies in your browser. Once you get past the first page of recently checked proxies, half of em won't work. Straight from page 2 of their site,

"149.156.9.242:8080 w3cache.cyf-kr.edu.pl Transparent No 3/30/2003 9:29:46 PM 96.77"

...Well guess what:

$ telnet 149.156.9.242 8080
Trying 149.156.9.242...
telnet: connect to address 149.156.9.242: Connection refused
telnet: Unable to connect to remote host

There are a lot of bullshitters out there when it comes to proxies. I ain't one of em.

[SpaceAce]

Originally posted by Bulworth
Show me a site with 50K verified open proxies - I ain't talking proxies from 6 months ago, or hosts that happen to be listening on a proxy port but aren't really proxies - and I'll show you my dick. OK, I won't really show my dick, since page-widening posts are generally considered rude.. ;)

Seriously though, I doubt there's any site out there with 50K proxies, not even the DNSBLs have that many listed (we feed into the Osirusoft DNSBL, btw).

There are some bullshitter sites like

a) tools.rosinstrument.com - OK, do you really trust a site whose scripts are so fucked up that they still report the current year as "103"? Y2K was 3 years ago. If they haven't fixed that yet, I wonder what else they haven't fixed... Like, oh, maybe, their proxy testing/scanning engine...

b) atomintersoft.com - they claim "422210 proxy servers in database" but you notice they don't bother to mention how many are open. There aren't 420K open proxies in the world right now, let alone in a single database. Try using 10 or so of the "proxies" listed at atomintersoft as proxies in your browser. Once you get past the first page of recently checked proxies, half of em won't work. Straight from page 2 of their site,

"149.156.9.242:8080 w3cache.cyf-kr.edu.pl Transparent No 3/30/2003 9:29:46 PM 96.77"

...Well guess what:

$ telnet 149.156.9.242 8080
Trying 149.156.9.242...
telnet: connect to address 149.156.9.242: Connection refused
telnet: Unable to connect to remote host

There are a lot of bullshitters out there when it comes to proxies. I ain't one of em.

I wasn't going to say anything, but OK.

9K is nothing. I can have 50,000 working proxies by this weekend without even breaking a sweat. It's no trick to scan several thousand per day on DSL and there are plenty of sites out there with working proxy lists updated daily. They're all free, too. If you add in certain pay services, the list gets even bigger.

I don't know either of the sites you mentioned in your post, but I do know of others who update often and have actual working proxies. Like I said, though, even raw scanning will produce tons of open proxies, most of which will probably not be on your 9K list. When you factor in how fast proxies die and fresh ones get spread around, it's pretty much an impossible task to keep up.

A service like yours is an OK place to start, but it isn't a miracle cure. For the record, the most verified working proxies I have ever had at one time is about 140,000. I will note, though, that about 1/2 - 2/3 of them were not <B>really</B> anonymous (spilled IPs), and many of them were sequential (several proxies running on one server or group of servers), but still...

SpaceAce
P.S. to people reading this post: Unless I know you, please don't ask where to get them or how to scan them. I am not going to tell you. We have enough problems, already. The last time I participated in a discussion like this on a message board my ICQ went nuts with people wanting proxies.

[SpaceAce]

Also, am I the only one who thinks that site looks geared more towards providing the scamming bastards with proxies than with helping me keep the scamming bastards out?

SpaceAce

[nuclei]

SpaceAce actually openproxies provides scripts that you can install on your site to scan and redirect open proxies.

As for number of proxies, I dont think shaun actually keeps any dialup based proxies. Anyplace that has over 10k proxies will be 90% dialups.

[Bulworth]

Originally posted by SpaceAce
I wasn't going to say anything, but OK.

9K is nothing. I can have 50,000 working proxies by this weekend without even breaking a sweat. It's no trick to scan several thousand per day on DSL and there are plenty of sites out there with working proxy lists updated daily. They're all free, too. If you add in certain pay services, the list gets even bigger.

I doubt the 50K number. This isn't a personal attack, I'm just speaking from experience at personally running a proxy database for more than a year. We spider a lot of the free sites, as well as doing a bit of probability-based scanning (e.g. concentrated probes where we have multiple proxies in the same /24, and test probes where we have multiple proxies in the same /16), and testing inbound connections for proxies. I ran this off my cablemodem for 10 months, so indeed, DSL would have no problem scanning thousands. Now that we're sitting on 10Mbps we've improved our scanning drastically.

I don't know either of the sites you mentioned in your post, but I do know of others who update often and have actual working proxies. Like I said, though, even raw scanning will produce tons of open proxies, most of which will probably not be on your 9K list. When you factor in how fast proxies die and fresh ones get spread around, it's pretty much an impossible task to keep up.

I would agree that some of the proxies you'd find wouldn't be in our list - no list is comprehensive, and no list ever will be. However, I'd like to speak on the idea of how fast proxies come and go. In particular I'd like to counter with a few things from our internal stats page:

The oldest open proxy in the database is 194.78.zzz.240:80 (added 393 days ago).
The oldest anonymous open proxy in the database is 194.78.zzz.240:80 (added 393 days ago).

...all proxies aren't as transient as you may think...

Total:
There are currently 25144 records in the database, including both 
tracked and untracked proxies.
Tracked:
9459 proxies are open (1798 of those are anonymous), 13371 
are closed, and 141 are in an unknown state due to a connection 
timeout.
Untracked:
There are 2169 proxies which have been marked as duplicates 
(transparent proxies which point at another proxy, etc.) and 3 
proxies have been barred from future probing by administrative request. 

1 proxy was found to be operated by the US government or 
military without reverse DNS, and manually blocked from further 
probing. This proxy would never have been probed, scanned, or 
added to the database to begin with if proper reverse DNS had 
been in place.

...though they certainly are transient to an extent. Point being, you could give me a list of a billion supposed proxy IPs, it's worthless unless it's scanned repeatedly every day. Rosinstruments' site (and many other free proxy sites) are good examples of "big proxy lists" gone awry, where not only do many of the IPs listed not actually proxy HTTP connections, they aren't tested routinely enough to make the list worth anything. Even if you could come up with 50K proxies by this weekend, 40K of them would be dead by the time you finished compiling the list. And there's the rub. No other site probes as frequently as we do, no other site lists as many real, live, verified proxies as we do. I've been looking for viable competition for 393 days and I haven't found it yet.

I wish I had some way to determine the number of hosts probed (from hundreds of sources, including both free and paid proxy lists) vs the number which were actually open proxies at any given time. Unfortunately we don't keep track of hosts tested which were not open proxies on a historical basis. However I can say from looking at the stats from the most recent spidering run - which encompasses a variety of sites -

$ wc -l *list.txt
17429 badlist.txt
237 goodlist.txt

That is, out of nearly 18,000 "proxies" listed at various sites, less than 250 of them were actually open proxies. That's a pretty fucking bad track record in my opinion. OpenProxies.com's scanners fire up every 2 hours (probing the entire list of opens takes longer than that, so they overlap) but you're rarely going to see an IP in our list which was not open 12 hours ago or sooner. It's difficult to find such accuracy elsewhere unless you do it yourself - and that's the whole idea, not everyone can do it themselves. If you can, it doesn't bother me in the least.

A service like yours is an OK place to start, but it isn't a miracle cure. For the record, the most verified working proxies I have ever had at one time is about 140,000. I will note, though, that about 1/2 - 2/3 of them were not <B>really</B> anonymous (spilled IPs), and many of them were sequential (several proxies running on one server or group of servers), but still...

I find it difficult to believe that you had 140K valid, working open proxies at a time. Again, this is not a personal attack, I don't know you so I can't argue. It's merely a reflection of the facts I've seen. I refer back to atomintersoft who claims to have 200K+ proxies, most of which either are not public proxies, or were never proxies to begin with; and their number has been going up for years - if someone had 140K at a time, wouldn't there be freelists out there with that many, or more?

I think to the days of cyberarmy.com's proxy list, where their "tester" would report positive if a given host was responding on the speficied port. There was no actual attempt made to use the proxy. There are many such so-called "proxy lists" made up of IPs which are nothing more than webservers which don't actually relay HTTP requests.

The last time I participated in a discussion like this on a message board my ICQ went nuts with people wanting proxies.

In other words, the majority of people can't find 50,000 proxies on their own by this weekend, eh?

Anyway, I ain't saying you're BSing, just saying I have a tough time believing your numbers, and an even tougher time believing that those numbers could possibly be recent.

[strobi]

Ever heard of FXP groups? Those people have scanbots running all over the place... Thousand and Thousands and thousands of open proxies, all verified, all sorted by speed... sick. I'm not trying to bring down your program, it's a nice place to start and have some extra security! But 9000 is peanuts....

[goBigtime]

A lot of proxys go up and down a lot because peoples backdoored machines go up and down a lot (as they turn their computers on and off)

So while some proxys on your list might be "dead" during one part of the day, they will be active again during other parts of the day.

If you scan a lot of proxies you should know this.


And like SpaceAce sais... if your trying to provide assistance for people in the industry to protect themselves against crooks & hitbotters, then it's in the best interest of everyone to keep a list of all the proxies -- dead and 'alive'.

[SpaceAce]

I doubt the 50K number. This isn't a personal attack, I'm just speaking from experience at personally running a proxy database for more than a year. We spider a lot of the free sites, as well as doing a bit of probability-based scanning (e.g. concentrated probes where we have multiple proxies in the same /24, and test probes where we have multiple proxies in the same /16), and testing inbound connections for proxies. I ran this off my cablemodem for 10 months, so indeed, DSL would have no problem scanning thousands. Now that we're sitting on 10Mbps we've improved our scanning drastically.

I am not sure what you doubt about it. It isn't a theory, it's something I have done multiple times. As for "probability" scanning, that is just a natural part of finding proxies. There are certain ranges which tend to be a great deal more fruitful than others. A proxy-scanning newbie may not know that and would have less productive scans, but I don't think newbies are who we need protecting from.

The oldest open proxy in the database is 194.78.zzz.240:80 (added 393 days ago).
The oldest anonymous open proxy in the database is 194.78.zzz.240:80 (added 393 days ago).

...all proxies aren't as transient as you may think...

I did not say that all proxies were transient, only that a great number get found and die each day. As long as we're on the subject, though, <B>most</B> proxies <B>are</B> extremely transient. Proxies that remain open and usable for 393 days are the exception and not the rule. You know that. If you have been doing this for as long as you say, you must realize that. In fact, that is one of the main reasons your list needs to be of only 9K proxies, because of all the open proxies scanned and distributed in a given period of time, most of them die rather quickly.

...though they certainly are transient to an extent. Point being, you could give me a list of a billion supposed proxy IPs, it's worthless unless it's scanned repeatedly every day. Rosinstruments' site (and many other free proxy sites) are good examples of "big proxy lists" gone awry, where not only do many of the IPs listed not actually proxy HTTP connections, they aren't tested routinely enough to make the list worth anything. Even if you could come up with 50K proxies by this weekend, 40K of them would be dead by the time you finished compiling the list. And there's the rub. No other site probes as frequently as we do, no other site lists as many real, live, verified proxies as we do. I've been looking for viable competition for 393 days and I haven't found it yet.

As I said, I am not familiar with either of the sites you listed so I can't really say anything about them. To the issue of you vs your competition, that's between you and your customers. I am not comparing your service to any others. I've never paid for proxies because I have no problem getting my own when I need them. Your service may very well be the best of its kind, but you are expresing doubt about higher numbers of proxies just because you don't have that many. That's a bit egotistical.

I find it difficult to believe that you had 140K valid, working open proxies at a time. Again, this is not a personal attack, I don't know you so I can't argue.

I refer back to atomintersoft who claims to have 200K+ proxies, most of which either are not public proxies, or were never proxies to begin with; and their number has been going up for years - if someone had 140K at a time, wouldn't there be freelists out there with that many, or more?

Lets be honest, here, that is a personal attack. You've basically called me a liar. That's fine, I have a thick skin and I am not concerned with whether or not you believe me. The statement that I had 140,000 working proxies at one time is simple fact. To be more accurate, it was closer to 147,000. I rounded down.

About the "if someone had..." part, I don't see how one logically follows the other. I spent weeks culling those from various sources, weeding out the dead and useless ones and scanning my own to compile the list. At it's height, (both working and non-working) I had over 800,000 lines in my proxy database just from lists I found on the net. All proxies were by IP address, so there were no duplicates (there were gateways, of course, but no duplicate IPs). The vast majority of those 800,000 were crap, but between those and the ones I scanned I put together a whopping list of usable proxies. Obviously, they were of the flaky sort (up and down, dead in a day, etc) but if someone were looking to conduct shady activities, that list would have been more than enough.

I think to the days of cyberarmy.com's proxy list, where their "tester" would report positive if a given host was responding on the speficied port. There was no actual attempt made to use the proxy. There are many such so-called "proxy lists" made up of IPs which are nothing more than webservers which don't actually relay HTTP requests.

Again, you are referring to other specific services that I have no experience with (I am familiar with CyberArmy, but I never used their proxy list) and none of the places you mention are among those I visit or have visited in the past. Even if you have the best up-to-date verified list available from any service like your own, it's still only 9K proxies. They may all work all the time, but a person who wants to hack or card or hitbot only needs proxies that will be live for hours or even less. Those are extremely unlikely to be on your list because they are up and down so fast and those make up the majority of the proxies in use.

In other words, the majority of people can't find 50,000 proxies on their own by this weekend, eh?

Anyway, I ain't saying you're BSing, just saying I have a tough time believing your numbers, and an even tougher time believing that those numbers could possibly be recent.

Most people probably can't find 50,000 by this weekend. The thing is, they only need to find, say, 9,500 to completely get around being blocked by your service.

Again, you're expressing doubt about my statements. Take some time and look around at my posts. You'll find plenty of people here who don't like me because we've had an argument or I don't share their views or some other petty reason but you won't find anyone who will tell you I've ever done them wrong in a business deal or lied to them or claimed to have something I don't have or be able to provide something I can't provide or be able to do something I can't do. Basically, you're not going to find a single person who has had any dealings with me that will tell you I am dishonest in any way.

I never said that list was recent. It has been a couple of years since I had the giant list but I have had use for proxies dozens of times between then and now and I am quite confident that I could produce what I said I could if I had incentive to do so. Leaving that aside, I could most certainly find more than 9,000.

My reply was not meant to imply that your site is sub-standard. I just felt the need to say something when you basically waved off the idea that anyone could have more than you.

SpaceAce