Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links


Categories

In this Discussion

› › Recommend me some good services for detecting VPN, proxy or datacenter IPs
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

Recommend me some good services for detecting VPN, proxy or datacenter IPs

Special1Special1 Member
in Help

I need some recommendation for free or paid (not so expensive though) service which can detect majority VPNs, proxies or IPs coming from datacenters.

I already checked maxmind official site and they have something like this:

https://www.maxmind.com/en/geoip2-anonymous-ip-database

As you can see they only do that for enterprise-level applications and is subject to custom terms and pricing.

Is there any service which provide this? How could I detect this cost effectively?

Comments

  • WHTWHT Member

    @securedragon made a script. Hosted at github. Maybe someone will post the link

  • blackblack Member
    edited August 2015

    http://getipintel.net

    Feel free to pay me $5 / 1k queries.

    Thanked by 1GoatSeller
  • TriDoxiuMTriDoxiuM Member

    @Cakey made a great script on GitHub

  • tehdantehdan Member

    So that legit source of legit residential ips for your legit business - was it legit?

  • TripleflixTripleflix Member

    @black said:
    http://getipintel.net

    Feel free to pay me $5 / 1k queries.

    lol that bogus, my home ip (not proxied VPNed anything) gives a 0.994416296875 probability

    im really starting to wonder why thou...

  • blackblack Member

    @Tripleflix said:
    im really starting to wonder why thou...

    PM me the IP and I'll let you know why. It doesn't just look for proxies / VPNs anymore, it also looks for bad IPs.

  • tehdantehdan Member

    0.95 for my legit home ip :( are you sure your checker is legit?

  • TripleflixTripleflix Member

    PM sent, really wondering now...

  • blackblack Member

    Tripleflix said: PM sent, really wondering now...

    Replied.

    tehdan said: 0.95 for my legit home ip :( are you sure your checker is legit?

    PM me your IP and I can tell you why.

  • Special1Special1 Member
    edited August 2015

    @black said:
    http://getipintel.net

    Feel free to pay me $5 / 1k queries.

    Really like what I see. I tested some TOR IPs and also my Vultr datacenter IPs and they returned 1. I am not sure how accurate it is since many here reported that their home IP is returned 0.95 score or something. Also price is little too high for me. On maxmind they said I could use their Minfraud service which is 0.005 per query or 5$ / 1k that is the main reason why I am trying to find some good free alternative or atleast cheaper.

    https://www.maxmind.com/en/minfraud-services

    @WHT said:
    securedragon made a script. Hosted at github. Maybe someone will post the link

    I tried to PM him, but he doesn't exist on this forum?

    @tehdan said:
    So that legit source of legit residential ips for your legit business - was it legit?

    Yes. I closed that thread because I found a solution. Didn't like support and treatment which I received from some weird users. I think you was one of them...

  • blackblack Member
    edited August 2015

    Special1 said: I tried to PM him, but he doesn't exist on this forum?

    It's @KuJoe and if I'm correct, @WHT is referring to https://github.com/KuJoe/chkProxy which does maxmind lookups.

    Special1 said: I am not sure how accurate it is since many here reported that their home IP is returned 0.95 score or something.

    I'm talking to them now. One of the IPs was harshly judged, I'll make a commit later on in the day to fix it. The other, I'm not so sure but I will work with him to see if I can fix it. If there's any false results you can always email or PM me and I'll look into the issue and fix it.

    You don't really have to take any automated action, just have a warning system (like send yourself an email) and review it case by case.

    Thanked by 1WHT
  • CakeyCakey Member

    @Special1 said:
    Yes. I closed that thread because I found a solution. Didn't like support and treatment which I received from some weird users. I think you was one of them...

    Here, I will not give you the source like you asked in the pm so have what the other guy got

    I had this diagram somewhere over how I made ours Basically ours works in layers/levels.

    Basically it will port scan the ip with the normal stuff 80, 8080, 22, 21 etc if it doesn't find anything it pushed it to the next level. The next level scans port 5k-12k to fetch vip72's proxies, and so on. And at the end it whitelists the ip for a while from the whole process.

    Then I had a grouper that would check with a simple AI how many blocks per ASN there was and block the whole ASN if found too many or too many servers/websites

  • ManiacManiac Member
    edited August 2015

    Scored 0.99970777108434 for a residential IP. @black

  • blackblack Member

    @Maniac PM me your IP.

  • Special1Special1 Member
    edited August 2015

    @Cakey said:

    Then I had a grouper that would check with a simple AI how many blocks per ASN there was and block the whole ASN if found too many or too many servers/websites

    TriDoxiuM said that you shared this script on GitHub. Why can't you share this with me?

  • blackblack Member

    Settled the issue with @Maniac , it wasn't the code's fault and returned the correct result.

  • hawchawc Moderator, LIR

    0.64192 on my home (Virgin Media) IP

  • TravTrav Member
    edited August 2015

    @black said:

    Hah, My residential IP got a 0.116 result. AT&T

  • dragon2611dragon2611 Member

    0.99598185240964 for my VDSL2 at home

    0.99283375 for the ADSL2+ at home

  • blackblack Member
    edited August 2015

    hawc said: 0.64192 on my home (Virgin Media) IP

    Trav said: Hah, My residential IP got a 0.116 result. AT&T

    Sounds fine. Admins should really be looking at IPs > 0.97. 0.50 is like flipping a coin and guessing if it's a proxy or not. I don't recommend admins doing anything to IPs < 0.80 (at least in an automated manner). The real value it generates lets sysadmins draw their own lines like 0.97+ is automatic error message, 0.90+ is manual review, etc (which is much more helpful than returning "yes it's a proxy" vs "no it's not a proxy")


    The system has served over 2 million queries last month and I've had about 2 valid complaints that was fixed. 2 / 2 million is not too shabby. You can and should contact me if you feel like something is wrong, I'll do my best to fix it.

    Back on topic, there are other free solutions like http://www.shroomery.org/ythan/proxyblock.php and there's blocked.com which is a paid solution that hasn't been mentioned.

  • ValdikSSValdikSS Member

    http://witch.valdikss.org.ru/

  • blackblack Member

    Ah yes, I forgot about witch. Great article on medium @ValdikSS

  • CakeyCakey Member

    Special1 said: TriDoxiuM said that you shared this script on GitHub. Why can't you share this with me?

    didn't share a script I shared data, https://github.com/Zalvie/nginx_block_files

  • hienryhienry Member

    Some workaround has been shared in PHP classes that may help out.
    http://www.phpclasses.org/blog/post/391-Detecting-Malicious-Users-behind-Anonymous-Proxies-using-IP2Proxy.html

  • yorkyork Member

    You need an accurate IP base like ipip.net.

Sign In or Register to comment.