blocking proxy hits - GoFuckYourself.com

Zester · 03-02-2005, 04:53 AM

i'm trying to build a very simply a trading script in PHP
I'm looking to do some anti cheating features, how do I detect proxy hits?
is there anything 100% bullet proof?

i'm already ignoring hits I can't plant cookies on or can't get the IP address from

Trent Edison · 03-02-2005, 05:01 AM

If proxy is not "high anonimity", you can analyze HTTP reqests and detect them if there are parameters like "Via:", etc. In case of "high anonimity" proxies you have no means to detect except if you have the full list of "high anonimity" proxies in the internet.

Rorschach · 03-02-2005, 05:04 AM

Http_via =
Http_x_forwarded_for =
Http_from =

Zester · 03-02-2005, 05:38 AM

Quote:

Originally Posted by Trent Edison

If proxy is not "high anonimity", you can analyze HTTP reqests and detect them if there are parameters like "Via:", etc. In case of "high anonimity" proxies you have no means to detect except if you have the full list of "high anonimity" proxies in the internet.

is there really a full list of "high anonimity" proxies ? where can i get it?

chupachups · 03-02-2005, 06:12 AM

Quote:

Originally Posted by Zester

is there really a full list of "high anonimity" proxies ? where can i get it?

lolol no I dont think so

better just go with:

Http_via =
Http_x_forwarded_for =
Http_from =

Zester · 03-18-2005, 01:31 PM

any other methods of cheating I should know about?

azguy · 03-18-2005, 01:49 PM

Quote:

Originally Posted by Zester

any other methods of cheating I should know about?

It's not easy to block proxy hits, but it is doable to some extent.

What you could theoretically do is, run a batch script that scans through your log of whatever type, extracts the IP address, and attempts to connect to it as if it was a proxy server (check all ports for an open HTTP/Socks proxy). This can be a slow process, which is why you should never do it on-the-fly and only in batch. Also, you shouldn't wait too long before you check an IP, as proxy servers tend to die fast and your `evidence` will be lost.

EDIT: Needless to say, when a proxy is found you can cancel that specific hit/sale or do whatever you want with your findings.

Zester · 03-18-2005, 02:32 PM

Quote:

Originally Posted by azguy

It's not easy to block proxy hits, but it is doable to some extent.

What you could theoretically do is, run a batch script that scans through your log of whatever type, extracts the IP address, and attempts to connect to it as if it was a proxy server (check all ports for an open HTTP/Socks proxy). This can be a slow process, which is why you should never do it on-the-fly and only in batch. Also, you shouldn't wait too long before you check an IP, as proxy servers tend to die fast and your `evidence` will be lost.

EDIT: Needless to say, when a proxy is found you can cancel that specific hit/sale or do whatever you want with your findings.

thanks for that idea
now are there any other methods of cheating/faking hits besides the usage of proxy?

azguy · 03-18-2005, 02:41 PM

Quote:

Originally Posted by Zester

thanks for that idea
now are there any other methods of cheating/faking hits besides the usage of proxy?

There are plenty

Zester · 03-18-2005, 02:46 PM

Quote:

Originally Posted by azguy

There are plenty

care to list a few?

azguy · 03-18-2005, 02:47 PM

Quote:

Originally Posted by Zester

i'm trying to build a very simply a trading script in PHP
I'm looking to do some anti cheating features, how do I detect proxy hits?
is there anything 100% bullet proof?

i'm already ignoring hits I can't plant cookies on or can't get the IP address from

Why do you ignore hits that block cookies? I wouldn't do that. If someone wants to fake hits, it's very easy for them to accept cookies (cURL+PHP can easily do that). You're just losing real hits using this approach.

azguy · 03-18-2005, 02:50 PM

Quote:

Originally Posted by Zester

care to list a few?

It really depends on what you're trying to accomplish. Where do you block hits (what is the type of service that you have)?

Cheaters customize their behvaior based on what the need is, so I can't give a general answer. If they try to cheat pay-per-click systems, then in addition to getting unique IPs by using proxies, they will also try to trick users into hitting your pages.

azguy · 03-18-2005, 02:52 PM

These days it's not so easy to detect SOCKS proxies as it used to be. Back in the day you knew it's a SOCKS if port 1080 was open. Now you'll see all kinds of different ports - 44444, 323232, 34000, etc.

Zester · 03-18-2005, 03:07 PM

come to think of it: MSNTV is a proxy, AOL is a proxy, Earthlink is a proxy...Most cable modems are proxies....

azguy · 03-18-2005, 03:08 PM

Quote:

Originally Posted by Zester

come to think of it: MSNTV is a proxy, AOL is a proxy, Earthlink is a proxy...Most cable modems are proxies....

But you can still ignore those. They are mostly used by an actual legit user, as they are not public.

azguy · 03-18-2005, 03:09 PM

If you tell me what you're trying to do, I'll have more specific ideas for you. Hit me up if you don't want to post it here.

Zester · 03-18-2005, 03:59 PM

Quote:

Originally Posted by Rorschach

Http_via =
Http_x_forwarded_for =
Http_from =

I tested the following:
while (list($key, $val) = each($_SERVER)) {
echo "$key => $val<br>";
}

accessing the page myself I got:
HTTP_VIA => 1.1 PTK-CACHE-218B (NetCache NetApp/5.6.1D21)
HTTP_X_FORWARDED_FOR => 86.179.229.242

so did I miss something?

pstation · 03-18-2005, 04:27 PM

A lot of proxies dont expose them as being proxies, what you can do however is attempt to connect to the remote host on the common ports that proxies run on.

So you could possible do something like this provided you are running PHP:

PHP Code:


			
<?

if(fsockopen($_SERVER['REMOTE_ADDR'],8080,$ERRNO,$ERRSTR,0.5) hahahaha= FALSE)

{

    print "omg proxy server!!!11!";

}

?>

03-02-2005, 04:53 AM	#1
Zester Confirmed User Industry Role: Join Date: Jul 2003 Posts: 5,344	blocking proxy hits i'm trying to build a very simply a trading script in PHP I'm looking to do some anti cheating features, how do I detect proxy hits? is there anything 100% bullet proof? i'm already ignoring hits I can't plant cookies on or can't get the IP address from __________________ * Mainstream ? $65 per sale * new male contraception

03-02-2005, 05:01 AM	#2
Trent Edison Too lazy to set a custom title Join Date: Jun 2003 Location: Freeport 7 Posts: 6,132	If proxy is not "high anonimity", you can analyze HTTP reqests and detect them if there are parameters like "Via:", etc. In case of "high anonimity" proxies you have no means to detect except if you have the full list of "high anonimity" proxies in the internet. __________________

03-18-2005, 01:31 PM	#6
Zester Confirmed User Industry Role: Join Date: Jul 2003 Posts: 5,344	any other methods of cheating I should know about? __________________ * Mainstream ? $65 per sale * new male contraception

03-18-2005, 03:07 PM	#14
Zester Confirmed User Industry Role: Join Date: Jul 2003 Posts: 5,344	come to think of it: MSNTV is a proxy, AOL is a proxy, Earthlink is a proxy...Most cable modems are proxies.... __________________ * Mainstream ? $65 per sale * new male contraception

03-18-2005, 04:27 PM	#18
pstation Confirmed User Join Date: Jul 2003 Location: chicago Posts: 1,135	A lot of proxies dont expose them as being proxies, what you can do however is attempt to connect to the remote host on the common ports that proxies run on. So you could possible do something like this provided you are running PHP: PHP Code: `<? if(fsockopen($_SERVER['REMOTE_ADDR'],8080,$ERRNO,$ERRSTR,0.5) hahahaha= FALSE) { print "omg proxy server!!!11!"; } ?>`

03-02-2005, 05:04 AM	#3
Rorschach So Fucking Banned Join Date: Aug 2002 Posts: 5,579	Http_via = Http_x_forwarded_for = Http_from =

03-18-2005, 02:52 PM	#13
azguy Confirmed User Join Date: Nov 2004 Location: Scottsdale, AZ Posts: 5,167	These days it's not so easy to detect SOCKS proxies as it used to be. Back in the day you knew it's a SOCKS if port 1080 was open. Now you'll see all kinds of different ports - 44444, 323232, 34000, etc.

03-18-2005, 03:09 PM	#16
azguy Confirmed User Join Date: Nov 2004 Location: Scottsdale, AZ Posts: 5,167	If you tell me what you're trying to do, I'll have more specific ideas for you. Hit me up if you don't want to post it here.