Subject: Re: security issue -- access to 192.168.0.1 and other reserved IPs through proxy allows access to residential router admin pages
From: DataImpulse Support Team <[email-masked]>
To: Mark Polyakov <[email-masked]>
Date: Fri, 2 May 2025 04:11:15 +0300

Greetings!

Earlier, you contacted us with the issue detected.

Thank you for raising this matter!

We are constantly looking for ways to improve our service, and your request
has been taken into consideration.

Since your appeal, we have been working on fixing it. The issue is now
fixed, and as a thank you and bonus, we have provided 100 GB of traffic to
your Residential plan.

Thank you for your interest in our service!

If you have any additional questions or suggestions, don't hesitate to
contact us. We are always in touch and open to discussions!

Regards,
DataImpulse Support Team

On Wed, Apr 30, 2025 at 2:07 AM DataImpulse Support Team <
[email-masked]> wrote:

> Hi there
>
> Thank you for reaching out to the DataImpulse Support Team!
>
> We highly appreciate the information provided and forwarded to our team.
>
> Best regards,
> DataImpulse Support Team
>
> On Wed, Apr 30, 2025 at 1:16 AM Mark Polyakov <[email-masked]>
> wrote:
>
>> I discovered that it's possible to access 192.168.0.1 through your
>> proxies. Tested with HTTP proxies in sticky mode.
>>
>> This is a major issue because 192.168.0.1 is usually a router login page
>> on residential networks, so any customer of DataImpulse can access the
>> routers of random residential networks, and possibly change router settings
>> maliciously.
>>
>> I attached a screenshot of a router I was able to log into through
>> DataImpulse; like many routers, it had a default username/password of
>> admin/admin.
>>
>> When you fix this:
>> (1) Be sure to block all reserved IPs
>> https://en.wikipedia.org/wiki/Reserved_IP_addresses
>> (2) Be sure to block domains that resolve to a reserved IP. I have been
>> testing other residential proxy providers as well, and many of them block
>> 192.168.0.1 but if you access a domain name that resolves to 192.168.0.1
>> you can still access the router login pages.
>>
>> Best,
>> -- Mark Polyakov
>>
>>
>
> --
> Thanks,
> DataImpulse Support Team
>
>

-- 
Thanks,
DataImpulse Support Team