Pale Moon's (well-hidden) inbuilt VPN???

[cannonmc]

On Wed, 09 Jun 2021 23:09:01 +0100, I wrote:
>The web page https://www.ceoemail.com/ says access is forbidden and I
>should contact this address.

I got a speedy reply from the site owner:
"Sorry, we block PaleMoon because its internal VPN is widely used for abusing and
hacking websites."

I didn't understand

[jobbautista9]

They are forbidding SeaMonkey and Firefox ESR as well, so they seem to be blocking by IP. And I'm 100% sure I'm not connecting from a VPN.

Just don't use that service. They clearly need a better sysadmin.

[New Tobin Paradigm]

That is the biggest pile of horseshit I have ever heard in my FUCKING life. WE, as a rule, tend not to EVEN like proxies, VPNs, OR the Pedophile Tor Network.. What fucking sense does it make to have a "hidden VPN" in the platform or application?

You tell those mother fucking lying asshole fucktards to report here at once and justify their bullshit claims.

I am SUPER PISSED.

[cannonmc]

I had a feeling this was the case.

I will report this to the CEO site. However I will be civil as it is a very useful site. I used Waterfox

[New Tobin Paradigm]

Why be civil to lying scumbags like that?

[cannonmc]

Because calling someone who offers a free service a 'lying scumbag' doesn't get very far. Actually calling anyone a lying scumbag is not my style.

But this just in:

"We'll try allowing it for a day or two and see what happens.

best wishes
Marcus"

[Moonchild]

"Sorry, we block PaleMoon because its internal VPN is widely used for abusing and
hacking websites."

That's 100% false, ridiculous, and quite libelous for saying it's being used for criminal activity.

So, unless they can prove that

1. We have an internal VPN service in Pale Moon (which we don't), AND
2. The alleged internal VPN is being widely abused (by whom? do they have metrics?), AND
3. This alleged internal VPN is used for abusing and hacking websites (which kind of abuse/hacking? which sites?)

I expect a formal apology from them. I will not stand for this kind of response. Maybe I need to contact my lawyers.

[New Tobin Paradigm]

Because calling someone who offers a free service a 'lying scumbag' doesn't get very far.

Well if they weren't lying scumbags I'd agree.

[Moonchild]

Maybe it's just ineptitude, Tobin. They might be attempting to "shoot the messenger" based on some abusive scumbag who used a Pale Moon browser/user agent in their hacking attempts. As if a UA isn't faked all the time.
But that still doesn't excuse the totally ridiculous claims of an internal VPN (which is very specific) or a claim of widespread abuse subscribed specifically to Pale Moon as a product.

[fatboy]

Sounds like a crappy excuse not to cater for certain browser and to make it easier for their web devs?

[New Tobin Paradigm]

The website is amazingly amateurish so it doesn't have any crazy js libs.

[van p]

I just clicked on OP's link and didn't have any trouble getting to the site. I guess "allowing it for a day or two" has begun.

[IMNdi]

Adding info on this:

I get a page when I access the address that tells me to knock it off with the VPN
https://i.imgur.com/zcw5dCI.png (image too wide for inline posting)

So I'm being detected as having one.

This page displays for me from
- home (IP very likely never had a VPN, specifically assigned to residential area)
- work (site was never a VPN in the sense that is was open, it has VPN on it because corporate)
- but not from mobile (4G).

Maybe it thinks that anyone having VPN available is ON a VPN? That would ceil the false positive rate as anyone accessing the internet from my work IP (and we have thousands of users over wifi) would be from an IP that "has VPN". I can't imagine anyone on a decent business not having some sort of VPN set up. Also fast response time means I'm probably on a list and not detecting on connect, so anyone accessing it probably "dirties" the IP.

An external port scan reveals I have 443 open and 80 at work and 443 at home plus both have IPSEC/L2TP set up. Maybe it uses these to detect "proxy or vpn". If it does, it detects you having a website (SSL/HTTP) hosting as a VPN too?

[Moonchild]

I took a moment to check. I don't get a 403, but I think I know what's going on with them.

They are listing contacting details including plain mailto: e-mail addresses of a metric ton of company leaders in the clear to be scraped and harvested by any bot or script. Of course that will be a treasure trove for spammers as these e-mails are all likely going to be valid.
So the site probably has seen plenty of abuse as a result (because of their own doing!) and potentially even plenty of angry e-mails from the spam targets (if I was a CEO of a UK company listed there and as a result being swamped with tons of SPAM, I would certainly have some choice words for him) when finding out their address is listed "in the open" and ready to be slorped up and used as spam targets. As a result they likely have started blocking entire net ranges in their web server to try and avert the scrapers (and likely also thinking our UA was some abusive piece of software as a result).

[WiseWolf]

It works now as far as I can tell, but I don't blame Moonchild for being insulted, I remember when he said that Random Agent Spoofer isn't a good idea.

So yeah, I am very much led to believe this project thinks nothing of vpns and tor.

So this is more than just a smear, its a huge insult to your credibility which should be rock solid.

Tor isn't always about pedos though, but I tend to think, that, tor browser frankly sucks ever since it went to base itself on firefox esr rather than palemoon.

Aka, webextensions firefox-esr is a waste and now, same thing for Tor Browser.

Basically, I don't trust either.

Tor Browser is supposed to be about privacy, and firefox-esr fails as a base for that.

Still, I gotta agree with Tobin, this is horse shit.

[Moonchild]

Let's not derail this thread to be about Tor. It isn't about Tor. It's about this website owner making false claims that Pale Moon is supposedly a widely-used hacking tool with an inbuilt VPN to hide its users' IPs from their "hacking targets". And that is just total horse shit indeed, and potentially very damaging if pushed through the wrong channels.