Thread: Is there a program to run IPs thru and check if they are proxy based?

A friend's forum gets attacked by users with multiple accounts. We know some of them, but I'm wondering if there is a program where you can run IPs and find out whether or not they have been generated by a proxy.

There are some proxy IP lists on the web. You might want to do a search for "proxy IP". If I remember right, the lists are fragmented. You may have to compile your own master list.

It would not be hard to write a script that indicates when a user's IP is on the list.

If you find a good list, please post the source here.

What type of proxies do you think the attackers use? because if they are using web-based proxies there are several ways to block their visits.
If they are using SOCKS it will be harder.

How are they attacking your friend's site?

One of the IPs keeps registering from the University of Texas. I honestly don't know if it is a ring of people or all the same guy, but want to help him getting to the bottom of it.

GeoIP has a open proxy filter: MaxMind - Proxy Detection

Or you can use "NJABL": njabl.org
(http://www.spamhaus.org/zen/index.lasso )

And since you mentioned its a forum .. you can also find many MODs/plugins for blocking open proxies.

like for phpBB : phpBB • Modifications database

For vBulletin, you can use the Check Proxy RBL on New User Registration plugin.

You could always try using the Blocklist Manager from BISS to search through IP lists of public proxies.

BLM has a default proxy IP blocklist list in it's sources which you can check against. The proxy list is updated daily from a large range of public proxy sources and includes TOR IP's, which are popular for abuse & spamming too.