False Positives with Unreal IRCd

------=_Part_20940_21931770.1213243505039
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

   Hi,
         I run BOPM for an IRC network i am a part of, and recently we
decided to open alternative ports for users to use in case 6667 was blocked.
These ports are as follows 7000, 7070, 8000, 8001, 8002.  While several of
these ports are known to be proxy ports (8000, 8001), and IRCd does not
classify as an open proxy.  Unreal IRCd via a web post will respond with:

> :daedalus.devnode.org NOTICE AUTH :*** Looking up your hostname...
> :daedalus.devnode.org NOTICE AUTH :*** Found your hostname
> :daedalus.devnode.org 451 GET :You have not registered
> :daedalus.devnode.org 451 Host: :You have not registered
> :daedalus.devnode.org 451 User-Agent: :You have not registered
> :daedalus.devnode.org 451 Accept: :You have not registered
> :daedalus.devnode.org 451 Accept-Language: :You have not registered
> :daedalus.devnode.org 451 Accept-Encoding: :You have not registered
> :daedalus.devnode.org 451 Accept-Charset: :You have not registered
> :daedalus.devnode.org 451 Keep-Alive: :You have not registered
> :daedalus.devnode.org 451 Connection: :You have not registered
>
>
HTTP post and requests will be more or less true, however if you notice that
is IRCd text, and the only reason its coming up as true is because its
outputting what the browser is saying. Now, if you were to connect via 8000
to daedalus.devnode.org,  you will get the IRC server.  No proxy exists, but
this results with BOPM as classifying it as a proxy, which has gotten
several of our servers, including mine (above) to be listen in DroneBL.  A
quick fix is to either disable the ports on the IRCd or disable checking of
those ports on BOPM. This does not have positive results, as BOPM has found
several actual proxies on port 8000.  Is there a way to solve this problem,
with a better fix, as I don't think open proxys reply with IRC server
responses.  :)

                                                      Thanks...

------=_Part_20940_21931770.1213243505039
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

&nbsp;&nbsp; Hi,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; I run BOPM for an IRC network i am a part of, and recently we decided to open alternative ports for users to use in case 6667 was blocked. These ports are as follows 7000, 7070, 8000, 8001, 8002.&nbsp; While several of these ports are known to be proxy ports (8000, 8001), and IRCd does not classify as an open proxy.&nbsp; Unreal IRCd via a web post will respond with: <br>
<blockquote style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;" class="gmail_quote"><pre>:<a href="http://daedalus.devnode.org">daedalus.devnode.org</a> NOTICE AUTH :*** Looking up your hostname...<br>
:<a href="http://daedalus.devnode.org">daedalus.devnode.org</a> NOTICE AUTH :*** Found your hostname<br>:<a href="http://daedalus.devnode.org">daedalus.devnode.org</a> 451 GET :You have not registered<br>:<a href="http://daedalus.devnode.org">daedalus.devnode.org</a> 451 Host: :You have not registered<br>
:<a href="http://daedalus.devnode.org">daedalus.devnode.org</a> 451 User-Agent: :You have not registered<br>:<a href="http://daedalus.devnode.org">daedalus.devnode.org</a> 451 Accept: :You have not registered<br>:<a href="http://daedalus.devnode.org">daedalus.devnode.org</a> 451 Accept-Language: :You have not registered<br>
:<a href="http://daedalus.devnode.org">daedalus.devnode.org</a> 451 Accept-Encoding: :You have not registered<br>:<a href="http://daedalus.devnode.org">daedalus.devnode.org</a> 451 Accept-Charset: :You have not registered<br>
:<a href="http://daedalus.devnode.org">daedalus.devnode.org</a> 451 Keep-Alive: :You have not registered<br>:<a href="http://daedalus.devnode.org">daedalus.devnode.org</a> 451 Connection: :You have not registered</pre></blockquote>
<div><br>HTTP post and requests will be more or less true, however if you notice that is IRCd text, and the only reason its coming up as true is because its outputting what the browser is saying. Now, if you were to connect via 8000 to <a href="http://daedalus.devnode.org">daedalus.devnode.org</a>,&nbsp; you will get the IRC server.&nbsp; No proxy exists, but this results with BOPM as classifying it as a proxy, which has gotten several of our servers, including mine (above) to be listen in DroneBL.&nbsp; A quick fix is to either disable the ports on the IRCd or disable checking of those ports on BOPM. This does not have positive results, as BOPM has found several actual proxies on port 8000.&nbsp; Is there a way to solve this problem, with a better fix, as I don&#39;t think open proxys rep
 ly with IRC server responses.&nbsp; :)&nbsp; <br>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Thanks...&nbsp;  <br></div>

------=_Part_20940_21931770.1213243505039--