Hinky’s Proxy Obsession

This morning my gold old Saudi proxy finally told me to fuck off.  What a shame!  I’ve been using it since at least January of this year.

But that’s the proxy biz for ya.

So I went to my favorite proxy list and pulled a Swedish IP off and put it into my SQUID configuration.

That worked for about 15 minutes.  It wouldn’t surprise me if that wasn’t really a Russian IP, since those proxies all tend to bump you off after a few minutes.

Then, a Polish IP.  Very fast.  Obviously NOT a hacked dsl or cable account, since the IP reverse resolved to a “real” host name.  It turned out to be a “real” Web server, shown below:

Love their hosting prices!  Everything is FREE!

So what’s up with that?  Clueless admin, playing with a staging or development site?  Or is it something more vile, like a fake hosting site?

Whatever it is, I’ve always been pleased with the performance of Polish proxies.  They’re probably #2 on my personal favorites list, right after Germany.  Still, I don’t expect it to stay up for long.

Apparently, nearly every open proxy in Mexico goes through this box.  Maybe that’s why they named it after a volcano.

Yes, I admit it.  Since yesterday I’ve been resurrecting dead proxies right and left, entertaining myself by watching the HTTP headers fly by (I am easily amused).  And going through the list I have noticed a few things.

For one, the “Proxies of 2008″ are dying off, which is to be expected.  There are only about 60 or so left.

Second, this month, August 2009, has been a great month for proxies!  Twelve full pages worth.  August has also been a great month for Mexican proxies, with most of them discovered on the 15th.  Most of them are going through the server in the title of this article.  It’s a shame I never bothered to put the VIA header in the database.  There’s a lot of good information there, lost forever.  Oh, well.

August 2008 was also a good month for proxies.  It was when we hit our first 1,000,000 boxes.  And if anyone besides me remembers back then, September 2008 was extremely dry.  Things did not pick up again until February of 2009.

Thirdly, the sites I mentioned yesterday as running “TeamViewer” all turned out to be a single IP address with 200 open ports (and probably more, since I started dropping any port less than 80 over a year ago).  And although they were running TeamViewer yesterday, all of them are open proxies today (so far, 40 out of the 200 open ports are now reporting as Transparent proxies in the list – I just haven’t hit them all yet).  Which means they’ll probably be dead tomorrow.

Here is the whois information on that particular IP:

Note they assigned a netname to a single IP address.  This seems unusual to me, but it could be a common practice (in fact this ISP does it a lot, if you look here and search for “SXTY”).  This probably at least partially explains the “here today, gone tomorrow” nature of Chinese proxies.  But the tie-in with “This site is running TeamViewer” is still a head-scratcher.  WTF is up with that?

I did solve my issue with the proxy judges that don’t return an Http-Referer header.  They still all return the User-Agent header, so I use that as well.  Still, I have a nagging suspicion that some proxy judges are lying to me.  I would use my own (yes, I have one of my very own design), but I have found that a lot of servers in foreign countires have difficulties resolving mrhinkydink.com.  Perhaps it may be useful as a backup of last resort for High Anon proxies (all the judges I use identify Transparent and Anonymous proxies faithfully).

Web site/false proxy detection (“Offline/WEB” in the database) is now rock solid.  I used to depend on the headers returned, but you will often get an “HTTP 200 OK” result for a login page instead of the expected (some RFC dweebs would say “correct”)  ”HTTP 403 Forbidden” result, followed by an “HTTP 302 Object Moved” to the login page.  You can’t expect Web developers to play by the rules, since they’re morons.

Other Tidbits

I keep checking the Israeli obfuscator site manually, although it has been removed from the code.  The name still resolves but the site times out and the nmap still shows port 80 as “filtered”.

I added “Cameroon’s favorite proxy list” under the page title, just for the Hell of it.

We added another 100,000 proxies to the database, hitting the 2.1 million mark this week.  And there’s more than 107,000 proxies in the “gold” table (address/ports that are or were open proxies since March 2008).

Something isn’t right with the code.  Right now there are 1140 proxies, but only 19 pages.  At fifty per page there should be 23 pages.  Come to think of it, this probably explains the missing proxies from 2008.

Unfortunately, I haven’t looked at the forum spammer’s reporting site since I started mirroring it.

Remember the Canadian hospital proxies?  They’re all gone now.  Someone figured it out and fixed it.  Good for them!

No sooner do I declare the Google Hack played out, it turns me into a liar.

Shortly after my last post, I ran the Hack one more time before putting it out to pasture. A few minutes into the run, it came up with one of “those” sites. It seems to have every kind of scam on the Net (lose weight, make money from Google/Craigslist, payday loans, etc.) and some type of blackhat SEO angle. There are dozens of text files listing “users” of various online forums, the accounts they use, URLs for their profiles, and…

… the proxies they use to post.

I ran a few Google searches on some of these names and they are absolutely everywhere. There’s hardly an online forums that hasn’t been hit by these accounts so it’s definitely a forum or comment SPAM operation of some sort.

I’m not sure if this is good news or bad news. I’ve done a few runs against what they’ve got and so far it appears they don’t have anything that isn’t already in my database, although I am getting a few new TIMEOUTs and port CLOSED results. In other words, dead crap.

Anyway, there is so much stuff here that I’m going to mirror the site and bang at it at my leisure. It’s well-indexed by Google, so it’s no Big Secret, but the last time I ran across a site like this it didn’t last more than a couple of months. And the information is so… varied… that an offline study is the best way to mine it.

Check back in to see how it goes!

At this moment, the second run of the Automatic Dead Proxy Eliminator (ADPE) is about half-way done.

ADPE is currently scheduled to run on Mondays, Wednesdays, and Fridays and its purpose is to glean dead proxies out of The List.

There were 13 pages – 630+ proxies – before it started. Now it’s down to 9 pages and 420-odd proxies. Proof positive, if you ever wondered about it in the first place, that they go fast!

Earlier, I speculated that the Bahrainian Proxy Problem might be taken care of on this run, but so far those boxes are still checking out to be up and running. I’m still curious as to what, exactly, they are, since port scans seem to imply they’re devices rather than computers.