Originally Posted by rowan

If this is for trading then you'll probably have to do more sophisticated long term analysis. Even if you can detect "anonymous" proxies (and many will NOT have any headers to suggest they're a proxy) there is no easy way to detect a load coming from a compromised Winbox. It's not a simple task, it cannot be done in real time with only the IP and headers of the request as parameters.