Wait a minute, thats just basic a Sock 4/5 connection routed through someones proxy server isn't it? These proxies that people log onto are just other peoples proxy servers left unsecure. I would imagine that the people who leave there servers like this open to the world don't even realize that others are massing with them. If they don't realize, then mostlikely the ports to connect to are at default (1080 and 26662) like what Mystical just said. So they can be anything, true, but the majority of the connections are on the 2 ports. If you blocked the 2, there is only a small handful of ports that people would leave open to the world that others would connect to, wouldn't it? If there were only a small handful, it doesn't correct massing completely but wouldn't it reduce it a whole lot?