BEWARE - Proxy Detector Script - used by several sites

portalweb

portalweb

Supreme Member
Joined
Jan 7, 2010
Messages
1,435
Reaction score
579
Hi,

I want to test to see how they can detect the proxy IP, by going to this site:

Code: 
http://whatismyipaddress.com/staticpages/index.php/advanced-proxy-test

Test result: Proxy server detected. (yes, I'm using paid proxy service while using this BHW)

IP 69.164.xxx.xx
rDNS FALSE
WIMIA Test TRUE
TOR Test FALSE
Loc Test FALSE
Header Test FALSE
DNSBL Test FALSE

Based on the tests with 15 different proxy IP addresses, all of them failed WIMIA test (and sometimes TOR test too).

What does it mean to us? They know we are attempting to hide ourselves from their sites through the proxy servers.

What I'm seeing here, it means we need to request the proxy providers to make sure that these IP addresses are not detected by proxy detector scripts, similar to whatismyipaddress.com's proxy detector.

Comments?
 
Last edited:
Advertise on BHW
Depending on the configuration of the proxy, it may actually be sending your IP address without your knowledge.

Some configurations of proxy servers inject a header called "X-Forwarded By: [Your IP]".

I suspect that the "proxy detector" is searching for that header as well as a database of known proxies.

Edit: Nevermind, I'm wrong.
 
This is a very intriguing topic, with many hardcore blackhat methods requiring the use of proxies to manipulate site thresholds, with CPA and affiliate sites using proxy detectors can we begin to build a "database" of CPA companies and affiliate networks that don't have proxy detectors?

Or perhaps write a script that checks for the proxy detectors before using proxies to access the sites.

There's definitely ways around anti-proxy security defense. We just have to check for what their checking for and give them false data to bypass their "check". :D
 
My best guess is that they're logging every single IP address that they can view.. Then, they're comparing the User-Agent with the IP address to check for major variations.

Alternatively, they could be checking for open ports on the IP address in question. Common ports such as 8080 would easily flag it as a proxy.
 
javascript can detect Proxy use - i wonder nobody here knows this.
 
Woot private socks ftw (false on all).

Question: what's a "Loc Test"?
 
they can detect proxy usage but i believe not vpns (someone correct me if wrong) =)
 
try this
Code: 
http://www.whoer.net/ext
it has advance detecting proxy and i think it can be use for credit card fraud
 
darkAsPitch said:
I noticed that too, can anyone find a defining link to what WIMIA is?

I assumed it meant that they checking against a database of ips of proxies that they had found somewhere.
Click to expand...

Here's a thread that I think explains what WIMIA is:

http://proxy.org/forum/1196102288.html

It sounds proprietary to whatismyipaddress.com - note the acronym and what it could spell out.

Here's the quote for those of us to lazy to click:

That's the test we're currently working on. It's using a non-cookie, non-javascript method to attempt to detect multiple users of the same IP address. Consequently it can give a false positive for people in a multi-user environment. We're working to find the correct threshold.
Click to expand...

So users of shared proxies could be nailed by this test.
 
bzy39 said:
try this
Code: 
http://www.whoer.net/ext
it has advance detecting proxy and i think it can be use for credit card fraud
Click to expand...

Good lord...what a depth of details!!! I can image how G-Ad-gay's Javascript (as well as CPA networks's programs/scripts) would have the proxy detection script built-in similar to whoer.net/ext to read all details on user's PCs.

Think about it - you can't fool these paying ad networks if you repeat the CPA toolbar installation that pays $1-3, even with different proxy IP addresses.
 
Port, Hostname, IP Location, Headers, and User-Agent are all easy ways to check for proxy use, with Headers being the easiest and most common.

A "high-anonymity" proxy is just one that doesn't send the X-Forwarded-For or other Proxy headers.
 
lol if i visit that site it doesnt detects my proxy. actually i'm logged in at the university VPN with squid proxy. that tool isnt really good so nothing to worry!
 
I agree. When I first saw this, I was freaking out, but then I realized if I clean my cookies and used clean proxies I was good to go.
 
I'm using private proxies and this is the result from whatismyipaddress:

Proxy server not detected.
IP (like I'd put that here!)
rDNSFALSE
WIMIA TestFALSE
TOR TestFALSE
Loc TestFALSE
Header TestFALSE
DNSBL TestFALSE

​
I'd say they're checking public lists for the WIMIA thing that OP got spotted on. I doubt if they have some sort of AI proxy spotter/sniffer.
 
My proxies are not detected by any of those, i just use private squid proxies on irregular ports. I think these kinda scripts are really only a danger to those that are using public/shared proxies or proxies on the common proxy ports.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top