How can i detect if an IP is a proxy ?

Discussion in 'vBulletin' started by Tearabite, Apr 15, 2008.

  1. #1
    is there any way to detect if a given IP is from a web-based or TOR proxy ? I have a few 'problem' members that are getting crafty..:mad:
     
    Tearabite, Apr 15, 2008 IP
    buffalo likes this.
  2. seo5000

    seo5000 Peon

    Messages:
    2,026
    Likes Received:
    231
    Best Answers:
    0
    Trophy Points:
    0
    #2
    If you have a current Vbulletin there will be an asteric (*) in front of the user name.
     
    seo5000, Apr 16, 2008 IP
  3. Tearabite

    Tearabite Prominent Member

    Messages:
    4,629
    Likes Received:
    429
    Best Answers:
    0
    Trophy Points:
    300
    #3
    well that would be cool.. but i'm using Drupal..

    I was hoping for some sort of online "IP Proxy check" or something along those lines.
     
    Tearabite, Apr 16, 2008 IP
  4. simplyg123

    simplyg123 Well-Known Member

    Messages:
    3,855
    Likes Received:
    186
    Best Answers:
    0
    Trophy Points:
    175
    #4
    i need to know this as well, i am using an smf forum
     
    simplyg123, Apr 16, 2008 IP
  5. buffalo

    buffalo Illustrious Member

    Messages:
    11,528
    Likes Received:
    1,014
    Best Answers:
    0
    Trophy Points:
    410
    #5
    Sounds like it's time to start using vB. ;)
     
    buffalo, Apr 16, 2008 IP
  6. EricBruggema

    EricBruggema Well-Known Member

    Messages:
    1,740
    Likes Received:
    28
    Best Answers:
    13
    Trophy Points:
    175
    #6
    But still no answer how to detect if someone using a proxy!
     
    EricBruggema, Apr 16, 2008 IP
  7. papa2ae

    papa2ae Active Member

    Messages:
    620
    Likes Received:
    7
    Best Answers:
    0
    Trophy Points:
    60
    #7
    One of my friends uses this php-script which doesnt allow users with proxy to get on the site - if thats what you need mate pm me and ill get you the name or the link :)
     
    papa2ae, Apr 17, 2008 IP
  8. Tearabite

    Tearabite Prominent Member

    Messages:
    4,629
    Likes Received:
    429
    Best Answers:
    0
    Trophy Points:
    300
    #8
    PM sent, but i've tried several of those, and all they do is block visitors with certain headings that indicate they're coming from a Proxy.. anonymous web-proxies dont have those headings so the scripts are useless.
     
    Tearabite, Apr 17, 2008 IP
  9. foromaestros

    foromaestros Banned

    Messages:
    42
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #9
    Hi
    I don\'t have the answer, how to detect if someone using a proxy!. But everybody should know that proxy server is very important in the organizations because it protect our system of intruders
     
    foromaestros, Apr 21, 2008 IP
  10. simplyg123

    simplyg123 Well-Known Member

    Messages:
    3,855
    Likes Received:
    186
    Best Answers:
    0
    Trophy Points:
    175
    #10
    If your using a proxy its only for a few reasons. And they all end up being you, doing something you aren't supposed to be doing.
     
    simplyg123, Apr 21, 2008 IP
  11. Tearabite

    Tearabite Prominent Member

    Messages:
    4,629
    Likes Received:
    429
    Best Answers:
    0
    Trophy Points:
    300
    #11
    so it seems there is no good, foolproof way to detect if an IP is a proxy or not, but here is what i've started doing:
    For suspected IP's (aka naughty members) I do a whois on the IP they're coming from. If the IP shows as being owned by Comcast, Verizon, etc (valid ISPs), chances are low that it is a web-proxy.. but - if the WHOIS says the IP belongs to a SERVER, or a hosting company, chances are HIGH that it IS a web-proxy.. makes sense when you think about it..

    I've caught SEVERAL web-proxy users this way..
     
    Tearabite, May 1, 2008 IP
  12. Lastbutnotleast

    Lastbutnotleast Peon

    Messages:
    2,612
    Likes Received:
    105
    Best Answers:
    0
    Trophy Points:
    0
    #12
    For instance buying something in a country for somebody living in that country - while you are living in another one [that's my case]

    No big deal :)
     
    Lastbutnotleast, May 12, 2008 IP
  13. simplyg123

    simplyg123 Well-Known Member

    Messages:
    3,855
    Likes Received:
    186
    Best Answers:
    0
    Trophy Points:
    175
    #13
    Is that not allowed?

    If i wanted to purchase a French poodle (from a France website) to send to my French cousin, (in France) Would that not be allowed because i am in the US?

    I may be wrong but i believe most websites do not care where you are from if you buy their stuff, i do business every day with foreigners.

    But some business's may request that buyers are from that country, and I'm sure they have their reasons, whether it be taxes, or what ever.

    Again i may be wrong but, heres a thought.

    If I'm a legit business, and I sell something to someone in another country, I'm sure their are some kind of tax issues that come with the sale, and i would imagine many businesses avoid these issues by keeping sales local.

    So, if they sold something to a foreigner, and charged them US taxes for it, their could be some kind of penalty.

    All this to say, if you are using a proxy, even in the manor you are, its causing a problem in some way or another to someone, or you are breaking some ones rules somewhere.
     
    simplyg123, May 12, 2008 IP
  14. Lastbutnotleast

    Lastbutnotleast Peon

    Messages:
    2,612
    Likes Received:
    105
    Best Answers:
    0
    Trophy Points:
    0
    #14
    It's not allowed where I want to order - It's stupid but it's like this :(

    It was just 1 example anyway

    Guess' US and Canadian online shop for instance ( http://www.guess.com ) - You can't order if you are not from the US or from Canada

    Of course most of the e-commerce sites (Amazon, Ebay ...) are not like this

    But it can happen for some services, for luxury and some brands ...

    It's a matter of taxes issues, marketing strategy and sometimes now because of currencies (the euro/dollar rate)

    Do you understand now why I disagree on this?

    ;)
     
    Lastbutnotleast, May 12, 2008 IP
  15. Master Joda

    Master Joda Peon

    Messages:
    22
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #15
    Try this checker - http://www.checkingtools.com/proxy_check
     
    Master Joda, Oct 8, 2009 IP
  16. Tearabite

    Tearabite Prominent Member

    Messages:
    4,629
    Likes Received:
    429
    Best Answers:
    0
    Trophy Points:
    300
    #16
    That checker just doesnt cut it for me.. So far this is the best method i've come up with for finding and blocking proxies: Checking and blocking proxies.
     
    Tearabite, Oct 11, 2009 IP
  17. alldaylinks

    alldaylinks Active Member

    Messages:
    692
    Likes Received:
    9
    Best Answers:
    0
    Trophy Points:
    85
    #17
    Have you tried to doing a reverse IP lookup or similar?
     
    alldaylinks, Oct 11, 2009 IP
  18. digitalpoint

    digitalpoint Overlord of no one Staff

    Messages:
    38,334
    Likes Received:
    2,613
    Best Answers:
    462
    Trophy Points:
    710
    Digital Goods:
    29
    #18
    You just need to get a big list of proxy IPs (they are publicly available).

    For me, those lists get dropped into a text file, then a run a custom script that generates a PHP file called filter.php that ultimately is just included in config.php

    My filter.php file looks something like this:

    <?php
    	if (preg_match("#^(11.22.33.44|12.12.12.12|13.13.13.13)$#", $_SERVER['REMOTE_ADDR']) || preg_match("#^(14.14.14.14|15.15.15.15|16.16.16.16)$#", $_SERVER['REMOTE_ADDR'])) {
    		header("Connection: close");
    		header('HTTP/1.1 403 Forbidden');
    		exit;
    	}
    ?>
    PHP:
    The script I use to generate the filter.php file does 500 IP addresses before it adds an additional preg_match() function since you will run into limits of preg_match with the strings being too long.
     
    digitalpoint, Oct 11, 2009 IP