3

Websites such as hackforums.net, amongst others, are able to detect if you're using a proxy or VPN just by looking at your IP address and block you if you are doing so.

I have never experienced any false positives either.

How does your IP address leak this information?

Even if one can do this effectively, is it a good thing to do?

  • 1
    They might have a list of commonly used IPs, but I doubt that would be complete enough to be usable. Another way is to look at the headers that some service providers send along with a forwarded request. If you google there are many sites that provide blacklists for common VPNs & proxies. However, the real answer is probably "they can't". There is no way to detect if a user is using a VPN by inspecting it's IP. If you try multiple different VPNs you will find that the site cannot detect each and every one of them. – Alex Dec 13 '15 at 9:27
  • Furthermore I think that you can clarify your questions title. – Alex Dec 13 '15 at 9:29
  • @Alex, ah, I see. I have tried to clarify the question title. – Lolums Dec 13 '15 at 9:57
  • 1
    Netblock assignment registration, whois information and reverse dns lookup, geolocation lookup. But then that's databases about IPs, not the actual IP. Though geolocation can be a scream due to dhcp assignment. Since IPV4 is getting low Qwest netblocks from a distant region can be assigned if the local pool gets low. Washington users getting Minnesota series addresses. iplocationtools.com has interesting info. – Fiasco Labs Dec 13 '15 at 18:38
5

How does your IP address leak this information?

It doesn't. IP addresses are not random things but different companies own different parts of the address range. Thus the usage of specific IP address does not change a lot, which also includes the range of IP addresses used for end users in DSL, cable or mobile networks or the IP addresses of VPN exits or public proxies.

There are several public services you can use to query the status of a specific IP. See for instance Dial-Up/Cable/ADSL IP Addresses at dns-rbl.com. Similar lists exist for known public proxies, VPN endpoints, Tor exit nodes...

Even if one can do this effectively, is it a good thing to do?

It is heavily used in fighting spam, i.e. end users are often denied to send mail to the mail servers of a specific domain directly, but must instead use the mail server of the mail provider with authentication. Since lots of spam traditionally was sent from botnets consisting of owned end user PC this blocking effectively reduced spam and thus is a good thing.

The same is with public proxies , VPN or Tor. While they have their use in providing (limited) anonymity for honest users they are often misused to circumvent access restrictions or to let an attacker or troll hide its identity when harming other users or companies. Preventing this misuse is in the interest of most and blacklisting these IP is a useful way, even though there is collateral damage against the honest users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.