Proxy / VPN Quality Check / Detection

Question

Is there any way to build a script which detects or rates proxies like Maxmind's proxy detection software?

I have already tried to use this code, but it doesn't detect all proxies, in fact it detect quite a low amount of proxies, while Maxmind can detect a lot more.

 if(
        !gethostbyaddr($_SERVER['REMOTE_ADDR'])
        || gethostbyaddr($_SERVER['REMOTE_ADDR']) == "."
        || !$_SERVER['HTTP_ACCEPT_ENCODING']
        || $_SERVER['HTTP_X_FORWARDED_FOR']
        || $_SERVER['HTTP_X_FORWARDED']
        || $_SERVER['HTTP_FORWARDED_FOR']
        || $_SERVER['HTTP_VIA']
        || $_SERVER['HTTP_FORWARDED']
        || $_SERVER['HTTP_CLIENT_IP']
        || $_SERVER['HTTP_FORWARDED_FOR_IP']
        || $_SERVER['VIA']
        || $_SERVER['X_FORWARDED_FOR']
        || $_SERVER['FORWARDED_FOR']
        || $_SERVER['X_FORWARDED FORWARDED']
        || $_SERVER['CLIENT_IP']
        || $_SERVER['FORWARDED_FOR_IP']
        || $_SERVER['HTTP_PROXY_CONNECTION']
        || in_array($_SERVER['REMOTE_PORT'], array(8080,80,6588,8000,3128,553,554))
        || @fsockopen($_SERVER['REMOTE_ADDR'], 80, $errno, $errstr, 0)
        || !$_SERVER['HTTP_CONNECTION']
    )
    {
        echo 'proxy';
    }
    else
    {
        echo 'no proxy';
    }

Any solutions?

Answer 1

There is no sure way to detect proxy/vpn usage. Aside from what you've done (which won't catch many users tbh), the biggest bang for your buck will be an IP blacklist (which is most likely how maxmind are detecting proxies).

Here are some sites that offer IP blacklisting (I have no experience with any of them):

• http://www.shroomery.org/ythan/proxyblock.php (free)
• http://www.projecthoneypot.org/?rf=41535 (free, but more general abuse protextion than proxying)
• http://www.blockscript.com/faq.php
• http://www.blockthatproxy.com/
• http://www.maxmind.com/en/home
• http://threatmetrix.com/

There are other tricks you can do to attempt to detect web proxies (like google translate, etc), which sometimes add extra headers. The problem is you'd have to add special cases for all of the ones that do (and most don't in any case).