I know how to whois an IP and various other tools to look into IP's but how do you tell if an IP is that of a proxy? Is there anyway at all to find out? Sorry but I am a noob at this stuff, trying to look out for my members.
You can check if any revealing headers are sent. However, if the proxy is elite (i.e. it masks everything), that won't help. The only other way would be to connect back to the IP that is connecting to your site for common ports (80, 3128, 3129, 8080, 8088, etc.). However, there is a major drawback: it will take ages for the tests to complete, and your visitors may be bored and leave Also, if the proxy is running on 25196 you won't detect it, unless you do a full portscan. Just my suggestion.
Hi, If you are using a forum or some script where you have source code access you may be able to check their IP address against a DNSBL like http://www.dronebl.org/ via a module or add-on although you'd probably have to write it yourself.
The user joined a forum I run with SMF, they have not posted, but I was checking into them and the IP is based on China and doesn't "seem" to be a proxy, but I don't know much about that. I will just keep an eye on them, a member is worried it's an ex, that's all.
If the proxy server isn't a high anonymous one, you can see HTTP headers that correspond to proxy requests. An easy way to see this headers is a firefox plugin called tamperdata that shows you a list with the headers of the proxy requests or any request that you do from your browser.