BEWARE - Proxy Detector Script - used by several sites

[portalweb]

Hi,

I want to test to see how they can detect the proxy IP, by going to this site:

http://whatismyipaddress.com/staticpages/index.php/advanced-proxy-test

Test result: Proxy server detected. (yes, I'm using paid proxy service while using this BHW)

IP 69.164.xxx.xx
rDNS FALSE
WIMIA Test TRUE
TOR Test FALSE
Loc Test FALSE
Header Test FALSE
DNSBL Test FALSE

Based on the tests with 15 different proxy IP addresses, all of them failed WIMIA test (and sometimes TOR test too).

What does it mean to us? They know we are attempting to hide ourselves from their sites through the proxy servers.

What I'm seeing here, it means we need to request the proxy providers to make sure that these IP addresses are not detected by proxy detector scripts, similar to whatismyipaddress.com's proxy detector.

Comments?

 

[websicosys]

Depending on the configuration of the proxy, it may actually be sending your IP address without your knowledge.

Some configurations of proxy servers inject a header called "X-Forwarded By: [Your IP]".

I suspect that the "proxy detector" is searching for that header as well as a database of known proxies.

Edit: Nevermind, I'm wrong.

 

[cookiejar]

This is a very intriguing topic, with many hardcore blackhat methods requiring the use of proxies to manipulate site thresholds, with CPA and affiliate sites using proxy detectors can we begin to build a "database" of CPA companies and affiliate networks that don't have proxy detectors?

Or perhaps write a script that checks for the proxy detectors before using proxies to access the sites.

There's definitely ways around anti-proxy security defense. We just have to check for what their checking for and give them false data to bypass their "check".

 

[pewtercraig]

If all come up as false, it is undetectable?

 

[portalweb]

If all come up as false, it is undetectable?

Theoretically yes.

 

[websicosys]

My best guess is that they're logging every single IP address that they can view.. Then, they're comparing the User-Agent with the IP address to check for major variations.

Alternatively, they could be checking for open ports on the IP address in question. Common ports such as 8080 would easily flag it as a proxy.

 

[xgnux]

javascript can detect Proxy use - i wonder nobody here knows this.

 

[TheGoat]

Woot private socks ftw (false on all).

Question: what's a "Loc Test"?

 

[rastagod]

they can detect proxy usage but i believe not vpns (someone correct me if wrong) =)

 

[ghprod]

so we need some vpn instead of socks?

regards

 

[portalweb]

Another hard-core proxy detection site (very good):
http://www.lagado.com/proxy-test (thanks to mrankin in his topic)
http://www.blackhatworld.com/blackh...list-membership-site-150-working-proxies.html
I will talk to my colleague (he has CCIE) about the proxy issue and will share the details here shortly.

 

[bzy39]

try this

http://www.whoer.net/ext

it has advance detecting proxy and i think it can be use for credit card fraud

 

[edvoltage1]

who cares..i still get paid.

 

[gregstereo]

I noticed that too, can anyone find a defining link to what WIMIA is?

I assumed it meant that they checking against a database of ips of proxies that they had found somewhere.

Here's a thread that I think explains what WIMIA is:

http://proxy.org/forum/1196102288.html

It sounds proprietary to whatismyipaddress.com - note the acronym and what it could spell out.

Here's the quote for those of us to lazy to click:

That's the test we're currently working on. It's using a non-cookie, non-javascript method to attempt to detect multiple users of the same IP address. Consequently it can give a false positive for people in a multi-user environment. We're working to find the correct threshold.

So users of shared proxies could be nailed by this test.

 

[portalweb]

try this

http://www.whoer.net/ext

it has advance detecting proxy and i think it can be use for credit card fraud

Good lord...what a depth of details!!! I can image how G-Ad-gay's Javascript (as well as CPA networks's programs/scripts) would have the proxy detection script built-in similar to whoer.net/ext to read all details on user's PCs.

Think about it - you can't fool these paying ad networks if you repeat the CPA toolbar installation that pays $1-3, even with different proxy IP addresses.

 

[goawayplease]

Port, Hostname, IP Location, Headers, and User-Agent are all easy ways to check for proxy use, with Headers being the easiest and most common.

A "high-anonymity" proxy is just one that doesn't send the X-Forwarded-For or other Proxy headers.

 

[radi2k]

lol if i visit that site it doesnt detects my proxy. actually i'm logged in at the university VPN with squid proxy. that tool isnt really good so nothing to worry!

 

[velcom7]

I agree. When I first saw this, I was freaking out, but then I realized if I clean my cookies and used clean proxies I was good to go.

 

[robertodelgato]

I'm using private proxies and this is the result from whatismyipaddress:

Proxy server not detected.
IP (like I'd put that here!)
rDNSFALSE
WIMIA TestFALSE
TOR TestFALSE
Loc TestFALSE
Header TestFALSE
DNSBL TestFALSE

​

I'd say they're checking public lists for the WIMIA thing that OP got spotted on. I doubt if they have some sort of AI proxy spotter/sniffer.

 

[JohnG]

My proxies are not detected by any of those, i just use private squid proxies on irregular ports. I think these kinda scripts are really only a danger to those that are using public/shared proxies or proxies on the common proxy ports.