Thread: Who Is Blocking You?

WebSense, SmartFilter, M86, ...

What other filters are creating business for proxy owners?

Do you think any are significantly better or worse than the competition?

As far as india is concerned . I have seen many schools and reputed organizations such as "Reliance" Seimens opting for inbuilt proxy blocker systems.

I have worked as an intern in both these companies and there systems were class apart. the second i could find any unblocked site it was blocked with in next 5 minutes . i could not understand what were they tracking to block such sites .

On school level my school had Websense and College used inbuilt system which was not updated i suppose lol as one could easily bypass with new proxies

Harshit

I'd say M86 is much better than WebSense and Smartfilter- You can use a literally just made proxy and as soon as you press "Browse" it gets blocked.

I have seen opendns working fine too it gets updated hourly i suppose

The filtering companies are going to crawl your site as soon as it gains any popularity. I would suggest blocking filtering companies and preventing unknown or shady bots from accessing your website or proxy entirely.

Originally Posted by IProx

The filtering companies are going to crawl your site as soon as it gains any popularity. I would suggest blocking filtering companies and preventing unknown or shady bots from accessing your website or proxy entirely.

how do u you block filtering companies??

Originally Posted by GrilledChicked

how do u you block filtering companies??

Check the links in his signature, he's promoting a solution.

Block Proxies, Bots, Filtering Companies, Scrapers, and more with BlockScript.

how do u you block filtering companies??

You can block filtering companies in your .htaccess file, IP tables or server firewall etc, or even use a free script like Autoban with Bad behavior or the ZB Block script, especially when you are on a shared server and don't have access to a server firewall..

Websense is one of the most common scanners, but there are quite a lot of companies who run bots looking for malware and things like proxies to block in their databases.

Here's an example of one session from the websense bot and it's magical useragent as it get's blocked and keeps trying to get through

208.80.194.28,BB2,[11-04-2010-08:53:57],static-208-80-194-28.as13448.com,403
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; YPC 3.2.0; SIMBAR Enabled; SIMBAR={2C2A8827-6619-49c3-A2EF-78930CFA6EBC}; SIMBAR=0; .NET CLR 1.1.4322),-

208.80.194.29,BB2,[11-04-2010-08:58:35],static-208-80-194-29.as13448.com,403
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 3.1; ZangoToolbar 4.8.2),-

208.80.194.29,BB2,[11-04-2010-08:58:58],static-208-80-194-29.as13448.com,403
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; iebar; (ntdll); .NET CLR 1.1.4322),-

208.80.194.28,BB2,[11-04-2010-08:59:52],static-208-80-194-28.as13448.com,403
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; YPC 3.0.1),-

208.80.194.37,BB2,[11-04-2010-09:06:56],static-208-80-194-37.as13448.com,403
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; FunWebProducts; SIMBAR Enabled; SIMBAR={0302242C-2182-494c-870B-236EDFB87A4B}; SIMBAR=0; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

208.80.194.36,BB2,[11-04-2010-09:09:28],static-208-80-194-36.as13448.com,403
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; SIMBAR={C46BA5E4-75B3-417d-BC2A-40881E317032}; .NET CLR 1.1.4322; HbTools 4.8.4)

208.80.194.36,BB2,[11-04-2010-09:09:35],static-208-80-194-36.as13448.com,403
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; FunWebProducts; .NET CLR 2.0.50727; IEMB3)

208.80.194.36,BB2,[11-04-2010-09:09:37],static-208-80-194-36.as13448.com,403
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; iP-CMPQ-2003; .NET CLR 1.1.4322),-

208.80.194.29,BB2,[11-04-2010-09:11:01],static-208-80-194-29.as13448.com,403
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Hotbar 4.3.5.0; FunWebProducts; (R1 1.5))

208.80.194.26,BB2,[11-04-2010-09:19:21],static-208-80-194-26.as13448.com,403
Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90; HbTools 4.8.4),-

All you need is the filtering companies IP's and have a way to dynamically detect them and block them if they aren't already listed yet.

Originally Posted by Mike-XS

All you need is the filtering companies IP's and have a way to dynamically detect them and block them if they aren't already listed yet.

Here's the range WebSense uses:

# WebSense
208.80.192.0/21

What other company ranges should we look for?

What other company ranges should we look for?

Here's a few I can remember.

Would be nice if we could get a comprehensive list put together, if anyone has more to add, it's free to share

Fortiguard
BlueCoat
WebSense
Mcafee - Safe Computing
OpenDNS/Phishtank - & all the other Phishing detection bots
Lightspeed systems security
Trend Micro
Cyberpatrol
M86
Cyveillance
urlfilterdb

My websense list for .htaccess is:

#Websense
deny from 66.194.6.0/24
deny from 69.67.32.0/20
deny from 67.117.201.128/28
deny from 204.15.64.0/21
deny from 208.80.192.0/21
deny from 212.62.26.64/27
deny from 213.168.226.0/24
deny from 213.168.241.0/30
deny from 213.168.242.0/30
deny from 213.236.150.16/28

For anyone looking for more examples of general menaces to block :
Corporate web abuse: The worst offenders from Cyveillance to PicScout

Just keep in mind that IP ranges can change at anytime, so IP's need to be rechecked every once in while. Don't copy and paste IP's from other sources without double checking them at sites like centralops.net and robtex.com. Older IP's for websense etc you can sometimes find on other sites may be inaccurate.

There's a short discussion of IP's to block and methods to use posted here:
IPs of "school filters" - an interesting discovery - Proxy.org Forum

You might also get lots of visits from companies like these guys :

Prescient Software, Inc. / Phishmongers
198.186.190.0 - 198.186.194.255
198.186.190.0/23
198.186.192.0/23
198.186.194.0/24

OpenDNS / Phistank are a menace to proxy owners, people from there will take your twitter feeds and plug them straight into the filter db to be blocked. All the anti-phishing companies who try to run malware and test phishing links through your proxy should be blocked too.

To pick up new IP's, I use the server logs to find the more stealthed connections. Sometimes where their identities are not obvious in the hostnames etc then you'll have to do some digging.

There's also a free script here from the phphantom site that claims to help block filtering companies, but I haven't tested it yet. *Edit* The free version is not Ioncube encoded.

This stealth spider bot will control is aimed at controling websense the filtering company.
Plus all the other web filtering companies we have heard of.
There Bad bots are spider bots that dont follow the normal rules robots.txt or the htaccess file.

Worlds only spider blocker stop websense from blocking your web site and all those other filting companys be free unblock now

More later..