Open proxy?

altis · 25-10-2004, 11:03

Just found this by going to www.dnsstuff.com:

Quote:

DNSStuff
WARNING: You are using a web proxy (80.5.160.5) that appears to be an open proxy, and is currently being abused by malware. You should contact whoever is in charge of your web proxy (if you aren't sure, contact your Internet provider) for assistance. You should let them know that the web proxy at 80.5.160.5 is broken (an 'open web proxy' that is being abused), and that the web proxy needs to be fixed. They can contact us (using our info@ address at the domain in the URL you are at; please refer to 5a00550) for further details. Searching your web proxy logs for 'netgeo.ch' will definitely find the rogue hits (but could possibly find some legitimate hits).

Sorry for the inconvenience, but we are under a DDoS attack, and your Internet provider is partially responsible.

This has never happened before on this site - sounds worrying

**Paul** · 25-10-2004, 13:51

Sounds unlikely.

That is the ntl transparent proxy that you use to connect the the site in question. What do they mean by "open" and "abused by malware".

It's a very vague and meaninless statement.

altis · 25-10-2004, 14:18

Whatever. It appears to have been sorted now

Quote:

You appear to be located in UNITED KINGDOM, based on your IP of 80.5.160.5

Florence · 25-10-2004, 15:13

Yes Bomber posted on his forums he was going in work and would let the network gurus to check it out.

Ignition · 25-10-2004, 21:58

Nothing to see here, move along please.

Sorry for the inconvenience, but we are under a DDoS attack, and your Internet provider is partially responsible.

Some people in your area probably infected by worm, and as their traffic is being redirected by this proxy it looks as though the proxy is compromised - it isn't, no changes made to Baguley caches or security settings that would open the proxy, just a vague and in this case misleading statement.

Hope that helps.

25-10-2004, 23:10

Quote:

Originally Posted by Ignition

Nothing to see here, move along please.

Sorry for the inconvenience, but we are under a DDoS attack, and your Internet provider is partially responsible.

Some people in your area probably infected by worm, and as their traffic is being redirected by this proxy it looks as though the proxy is compromised - it isn't, no changes made to Baguley caches or security settings that would open the proxy, just a vague and in this case misleading statement.

Hope that helps.

It does - thankyou

fragless · 24-12-2004, 16:11

Quote:

DNSStuff

WARNING: You are using a web proxy (62.252.192.7) that is currently being abused by malware. You should contact whoever is in charge of your web proxy (if you aren't sure, contact your Internet provider) for assistance. You should let them know that the web proxy at 62.252.192.7 is being abused and participating in a DDoS attack (and may be an 'open web proxy'), and that they must fix the problem. Searching the web proxy logs for 'netgeo.ch' will definitely find the rogue hits (but could possibly find some legitimate hits).

Sorry for the inconvenience, but we are under a DDoS attack, and your Internet provider is partially responsible.

PLEASE NOTE: This DDoS attack is bad enough when we have it under control. This is a free web site. We cannot let the attack damage us further by taking many hours of time responding to everyone about how to manage web proxies. If you do not know what a web proxy is, or do not run one, you must contact your Internet provider for assistance. If you do run one, you should be able to search your log files for 'netgeo.ch?IP=xxx.xxx.xxx.xxx' (where xxx.xxx.xxx.xxx is the IP of your web proxy) to find these hits. Our site automatically will de-ban your IP within about 24 hours, so you do not need to contact us to get access again. If you are still banned 24 hours later, the hits are still coming. And yes, we do know what web proxies are, and no, we are not blocking you because a lot of people access our site through the web proxy -- we are blocking you because you are providing web access to someone who is running malware that is abusing our site.

Having the same problem

**Paul** · 24-12-2004, 16:53

Just swap to another proxy.

It's a bit annoying that Dnsstuff really haven't a clue what they are talking about ...

Toto · 25-12-2004, 08:53

These errors clear after 24 hours, DNSstuff are aware that it is individual IP's that are responsible, and not the cache server they connect through. Like Paul M, it amazes me that whilst they know the actual IP's responsible and have a reporting route to get the problem solved, they still insist an banning the cache server(s).

Their loss to be honest, if you want some decent DNS type tools, visit http://samspade.org/t/