How to check for proxy IP?

Alessandra · 2009-11-30 1:31 pm

Please bear with me, because I'm really new (but willing to learn, honest!)

On another thread I ran across someone who somehow found out that an IP was "listed as an open socks5 proxy", which in the context seemed a really bad thing.

How do you find that out?

zaphod · 2009-11-30 1:51 pm

http://hosts-file.net/ has a find box that may show that.

http://whatismyipaddress.com/staticpage … /lookup-ip
and
http://www.robtex.com/

May be of help too.

Zap

P.S. ZB Block already has TOR anon proxy anti-registration checks in it.

RFiend · 2010-02-04 10:39 pm

There aren't any reliable ways of detecting a proxy. If it's doing a very good job of stealthing itself, it looks like a normal web access. I've seen lots of proxies that removed ALL of the 'forwarded for' type of headers, appearing to be Just Another Computer User.

However, if it's coming from a server farm (check the IP address at whois.domaintools.com/ followed by the IP address. Real people don't snack at server farms.

Last edited by RFiend (2010-02-04 10:39 pm)

MartinV · 2010-02-05 8:28 am

Usually I perform a search for the IP using Google like this:
http://www.google.com/search?q=173.25.232.50

Without opening any of the search results you can see whether it is an open proxy. Look for words like "socks" and "elite". In the search results you'll also see how recent they are, most of the time the date is mentioned.

This give you a clue whether the IP is in fact a proxy. You can not conclude it is not one if the Google search results do not contain evidence. However most of the time you will learn what you want to know.

zaphod · 2010-02-05 12:23 pm

Actually, TOR proxy exit nodes are 100% detectable, via forced self reporting in the TOR network. So that one problem can be neutralized fast.

See https://www.torproject.org/tordnsel/

I just block anything on that when it comes to registrations, confirmations, or logins, and I have no abuse problems through it.

Of course this does not include the other 99% of the proxy servers out there, or the infected Linux PHP hosts acting as proxy servers, but at least those don't move around like TOR. (Yes, I said Linux, because the windows PHP hosts out there invariably run anti-virus and are already detecting and killing most of the botnet php scripts.)

Zap

#1 2009-11-30 1:31 pm

How to check for proxy IP?

#2 2009-11-30 1:51 pm

Re: How to check for proxy IP?

#3 2010-02-04 10:39 pm

Re: How to check for proxy IP?

#4 2010-02-05 8:28 am

Re: How to check for proxy IP?

#5 2010-02-05 12:23 pm

Re: How to check for proxy IP?

Board footer