My server ip got greylisted. Is this from the proxy scraper?

mcscappum

My host told me to fix the issue. The warning they forwarded was the following:

https://bitninja.io/incidentReport.php?details=4530d83477e887ca8d

Is this from the proxy scraper?

If it is, is this because in the metric scanner I have "use real ip as well" selected?

Sven

According this report it is from proxy scraper I guess. However it just tries to use an IP as a connect proxy.
Thats all I can see here.

Why this should be a problem is however very questionable.

CONNECT 45.#.#.195:80 HTTP/1.0

mcscappum

@Sven Ok I'll write support (hostwinds) about it. 

mcscappum

@Sven this is from hostwinds support:

"This would be a problem as the server that this software was attempting to use as a proxy was not available as one, and filed a complaint.

You would need to ensure that this server is not in the list of potential proxies in order for us to consider this issue as resolved."

Do you know what servers these are so I can check them off?

Sven

common they just should act a bit more relaxed on this. Just because a normal HTTP protocol feeature (as this CONNECT) is used on a server wouldn't mean it's a malicious behavior. Thats just silly and ignorant.

If that server doesn't want to to be used (and yes in this case by a wrong mean) just don't put it online.
It's just silly to scream for action on this! It's like walking out and arguing that the air is a bit cold today! If so, just don't walk out!

Anyway, if they don't have the details to this, then sorry, they just show "45.#.#.195" as IP.

mcscappum

@Sven ;

Hostwinds seems to agree. Here is what they said:

"We have to forward complaints as received, BitNinja is lower on the priority list as their complaints are vague at best, but we do have to forward all complaints. At this time we would consider this one closed."

Sven

Ahh perfect. Im glad they see it the same as I. Everything else would just be too funny. Because all that happened is

1. open a tcp/ip connection to that IP:80
2. sending "CONNECT <other ip>:80"

The second a test if that server supports this feature.
There is nothing to worry about. IF that server does not want this, simplya reply with a 500 and it's OK.