Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is there any way to build a script which detects or rates proxies like Maxmind's proxy detection software?

I have already tried to use this code, but it doesn't detect all proxies, in fact it detect quite a low amount of proxies, while Maxmind can detect a lot more.

 if(
        !gethostbyaddr($_SERVER['REMOTE_ADDR'])
        || gethostbyaddr($_SERVER['REMOTE_ADDR']) == "."
        || !$_SERVER['HTTP_ACCEPT_ENCODING']
        || $_SERVER['HTTP_X_FORWARDED_FOR']
        || $_SERVER['HTTP_X_FORWARDED']
        || $_SERVER['HTTP_FORWARDED_FOR']
        || $_SERVER['HTTP_VIA']
        || $_SERVER['HTTP_FORWARDED']
        || $_SERVER['HTTP_CLIENT_IP']
        || $_SERVER['HTTP_FORWARDED_FOR_IP']
        || $_SERVER['VIA']
        || $_SERVER['X_FORWARDED_FOR']
        || $_SERVER['FORWARDED_FOR']
        || $_SERVER['X_FORWARDED FORWARDED']
        || $_SERVER['CLIENT_IP']
        || $_SERVER['FORWARDED_FOR_IP']
        || $_SERVER['HTTP_PROXY_CONNECTION']
        || in_array($_SERVER['REMOTE_PORT'], array(8080,80,6588,8000,3128,553,554))
        || @fsockopen($_SERVER['REMOTE_ADDR'], 80, $errno, $errstr, 0)
        || !$_SERVER['HTTP_CONNECTION']
    )
    {
        echo 'proxy';
    }
    else
    {
        echo 'no proxy';
    }

Any solutions?

share|improve this question
    
Based upon a similar response on SE sister sister, the answer is NO . Here is the link. stackoverflow.com/questions/858357/… –  Saladin Mar 19 '13 at 8:20
add comment

1 Answer

There is no sure way to detect proxy/vpn usage. Aside from what you've done (which won't catch many users tbh), the biggest bang for your buck will be an IP blacklist (which is most likely how maxmind are detecting proxies).

Here are some sites that offer IP blacklisting (I have no experience with any of them):

There are other tricks you can do to attempt to detect web proxies (like google translate, etc), which sometimes add extra headers. The problem is you'd have to add special cases for all of the ones that do (and most don't in any case).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.