There was a website I discovered a while back called "spur.us". The site collects information on IP addresses. Some of the information they collect is somewhat easy to find:

  • If the IP is part of a proxy network (easy to find out, purchase a subscription to a proxy network)
  • If the IP is a Tor exit node (easy to find out, Tor's bulk exit node list)
  • If the IP has used Tor (somewhat easy, set up a Tor guard node)
  • If the IP has used p2p file sharing (somewhat easy, listen in on DHT)

However, I'm a bit puzzled on how they find out the following information:

  • If the IP has connected to IPs on a proxy network (ie. they have used LuxSocks)

  • How many devices are on the IP address (see photo) example tor exit

  • Where the IP address traffic exits from and where its users are


  • If the IP address has connected to ProtonVPN

Along with other similar "fingerprints". How on earth do they know this? How can they tell how many people are using an IP address? Are they somehow listening to traffic on the Internet backbone?

  • I'm not quite sure how they do it, but my guess would be to host their own TOR exit nodes accross the world and see how much traffic they receive. Using that you can make a rough estimate of how much traffic flows through them (just a guess though)
    – Paradoxis
    Nov 25 at 15:33
  • How would they do it on IPs that are not Tor exits?
    – x43
    Nov 25 at 15:43
  • If they're proxies it's quite easy, just count the number of connected clients to your proxy; if they're random ip's: no clue
    – Paradoxis
    Nov 26 at 8:44

Browse other questions tagged or ask your own question.