How to determine the IP address of an anonymous proxy.

[частный детектив Кременчуг]

As you already know, there are anonymous proxies, using which you can surf the Internet anonymously. Are there any ways to "calculate" a visitor using anonymous proxy servers? Yes, there are. There are tools to both identify the visitor who uses different anonymous proxies and determine your IP address, even if you use an anonymous proxy server.

Cookies
At first glance, cookies have nothing to do with proxies. A cookie is a small piece of information that a server can transmit to a client in addition to the requested web page. The client’s browser stores this additional information and issues it upon server request. Cookies can be both during one session (after which they are deleted) and permanently stored on the client’s computer.
What are cookies for? For example, when you enter the site, you are asked for a password (say, by mail). After entering the password, it is stored in cookies and when you go from page to page (when you read messages), instead of asking for your password every time, the server takes it from cookies.

What gives a cookie to determine proxy? The IP address using cookies cannot be determined. However, when you first enter the web site, the server’s IP address (defined by the server, i.e. IP proxy) can be stored in cookies. And the next time you enter the site, the server again determines your IP and compares it with the cookies stored. And if the IP addresses (old and new) are different, the server "can draw conclusions." And if you do not prohibit cookies at your place, no proxy will help you (anonymizers can prohibit cookies directly at home without passing them to your computer).

JavaScript / VBScript

These are special routines (scripts) that are executed on the user's computer. Therefore, no matter how you configure the browser (unless you prohibit the execution of active scripts - these scripts), your real IP address will not be able to hide. These scripts are simple programs and have a rather limited set of functions, but theoretically they can determine your IP and many different settings of your browser. In addition, they (in principle) can even change your browser settings!

Protection against these scripts is multi-stage; you can restrict the access of scripts to one or another browser feature. However, the most reliable protection option is to completely prohibit the execution of active scripts. You can also prohibit scripts directly in anonymizers.

Java
Unlike JavaScript, Java is a full-fledged programming language and (as a result) Java programs have much wider capabilities (in particular, this concerns the definition of your browser settings and various functions for working with the Internet). That is, Java programs can easily determine your IP and almost any browser settings.

As for the protection from determining your IP address using Java, everything is more complicated: the most reliable (and probably almost the only) way is to completely ban Java, since Java has so many different network functions and it is problematic to disable them all.

ActiveX and plug-ins
ActiveX and plug-ins are plug-ins for the browser and various add-ons for the browser. These modules are actually complete programs that run on the user's computer. Therefore, they have much more features than Java and JavaScript. They can easily determine any browser settings, "calculate" your real IP address, and even easily change proxy settings!
Protection against them is a complete prohibition of ActiveX and the prohibition of automatic installation of plug-ins.

Rbl
There is another fairly effective way to "calculate" a proxy server. It does not give a 100% guarantee (not all proxies can be defined in this way), but you cannot protect yourself from it by changing any settings on your computer.
What is the essence of RBL proxy checking? Intenet has so-called “black lists” (“black lists”, RBL - Realtime Blackhole List), which were originally designed to combat spam (just search in Yandex for the phrase “what is RBL” to find out more about this). Currently, not only SMTP servers (through which spam can be sent) are entered into these RBLs, but also many proxy servers (through which spam can also be sent). These lists are (as the name implies: RBL - realtime) constantly updated and most operational (a proxy server can get into them within a few hours after spam has been sent through it).
How do I know if a proxy is on these lists? Very simple: you need to determine the IP address of the proxy, and then do a search in each of the RBL (there are a lot of these lists, just like, for example, search engines).
How does the site know that a particular proxy server is in one of the RBL? It is pretty simple. First of all: when you open a site, the site becomes aware of the client's IP address. The client (in case you connect through a proxy) is a proxy server. Knowing the IP address of the proxy (for the curious: this is the variable REMOTE_ADDR), the site sends a request to each RBL to find out if this IP is in this "black list".


Fighting "armor and shell"

The confrontation between those who want to be anonymous on the Internet and those who want to know everything about their customers will be eternal. There will be new tools to hide information about their movements on the Web and there will be new tools that "break through" or "circumvent" this protection.

There are several ways to protect yourself from determining your IP:

• 1 bans

• disable cookies

• prohibit execution of active scripts

• disable java

• disable ActiveX

• 2 use browser co-authentication. In this case, all the information that your browser (or other program) sends and receives is "intercepted" and sent to the proxy server.

• Use "clean" (i.e. not yet included in RBL, non-RBL) proxy servers. That is, each proxy must be checked at least 1-2 (preferably 10-20) of the most popular RBLs before use. There are special programs that allow you to check proxies for presence in RBL.

In the 1st case, “punching” such protection is very simple: just build a site based on Java / JavaScript / Cookies (for example, dynamic menus, etc.). In this case, when you turn off active scripts, the site will simply become "inactive" (and they may simply not let go of the web mail with cookies disabled).

In the second case, there is no 100% guarantee that your IP will be truly "hidden". We explain in more detail: there are 2 methods for determining your IP:
The Java program accesses the Internet directly, bypassing the proxy (it can, even if your browser is configured to work through a proxy) and the server "tells" the program what your real IP address is being analyzed Windows settings and the IP address is detected from the settings

So, co-authentication can protect against the 1st method of determining IP, but not from the 2nd!

In the third case, if the IP address is still in RBL (and the site checks for the IP client in different RBLs), then no proxy anonymity (even high anonymous / socks4 / socks5), ActiveX / Java / ban .... The main thing is that the IP address of the proxy server be "clean" ("not highlighted" in the "black lists"). At the moment (early 2005), very few sites are checking for an IP address in RBL.
So what to do if you really need to be anonymous and that Java / JavaScript / ActiveX are?

Let's look at exactly what the essence of the task consists of: so that, on the one hand, when analyzing the settings of the computer, it is impossible to find out the real external IP address, and at the same time, it is impossible to connect to the Internet directly (bypassing the anonymous proxy server).

There are 2 possible solutions to this problem:

1 You need to organize a corporate network, with internal IP addresses (192.168.1.x or something like that). The corporate proxy server (it is another computer and it has 2 IP addresses: internal and external) redirects all requests to an anonymous free proxy (in order to do this, you need the authority (and knowledge) of the system administrator). Bypassing the corporate proxy, it is impossible to connect to the Internet (since the computer does not have an external IP address), analyzing the settings of the computer, too. Even if the Java / ActiveX script determines (and "issues" to the web server) your internal IP address (192.168.1.x), this will not reveal your anonymity. In general, this can be considered 100% anonymity.

2 You need to install a Firewall on your computer in which to prohibit all Internet connections from the browser (except with the proxy server that you need). In this case, it is desirable to make port mapping to this free proxy server, and in the browser register “proxy” 127.0.0.1 and the local port from port mapping. But here a problem is possible - since you have a real and external IP address, it can be transferred to the server (the script will analyze the Windows settings and "give out" your IP).
The source of the article is https://russisk.ru/katalog-detektivov/de ... obi2Id = 107 - there you can find a list of proxies.

Here I present to your imagination an alternative firmware for routers of the DLINK DIR - *** family. Which has all the filters and the ability to use proxies.
Ideal for home and small office, let's not forget that there is WIFI in routers

The router was flashing this firmware from emergency mode. Before this firmware, the connection was constantly lost.

Sincerely, Alexander.

 

[Матушкин Андрей Николаевич]

Thank!

 

[Детективное агентство Оренбург ОДБ]

All this, of course, is true, but if the "object" has a gray IP address? What can this give besides information about the provider and the city of location? The “object”, in this case, gets a new IP address every time it connects to the network. So here it would be necessary to indicate that only for white IP-addresses.
It is much more relevant to determine the hardware address of the computer from which the "object" works (it is almost always unique), although here you can also find a way out for anonymous "surfing" - changing network cards.

 

[Саратов-Алиби]

Igor for sure, there was such a situation.

 

[Anonymous]

It is much more relevant to determine the hardware address of the computer from which the "object" works (it is almost always unique), although here you can also find a way out for anonymous "surfing" - changing network cards.

There is no need to change network cards. It is enough to go into the settings of the existing network card and put any MAC address there with pens. All this takes less than a minute. Accordingly, it is not necessary to talk about any uniqueness of the MAC address. Just few people know about this opportunity, therefore there is a misconception that the IAC is a unique, factory and unchanging address.

 

[Матушкин Андрей Николаевич]

It is much more relevant to determine the hardware address of the computer from which the "object" works (it is almost always unique), although here you can also find a way out for anonymous "surfing" - changing network cards.

There is no need to change network cards. It is enough to go into the settings of the existing network card and put any MAC address there with pens. All this takes less than a minute. Accordingly, it is not necessary to talk about any uniqueness of the MAC address. Just few people know about this opportunity, therefore there is a misconception that the IAC is a unique, factory and unchanging address.

Vlas, good day. Register on the forum, I think you will be an interesting conversationalist.
Thanks in advance.
Sincerely, Matushkin Andrey.

 

[Интересант]

define ip

 

[Саратов-Алиби]

define ip

AND???.........

 

[Матушкин Андрей Николаевич]

define ip

Provide details by mail.

 

[Stels]

It is much more relevant to determine the hardware address of the computer from which the "object" works (it is almost always unique), although here you can also find a way out for anonymous "surfing" - changing network cards.

There is no need to change network cards. It is enough to go into the settings of the existing network card and put any MAC address there with pens. All this takes less than a minute. Accordingly, it is not necessary to talk about any uniqueness of the MAC address. Just few people know about this opportunity, therefore there is a misconception that the IAC is a unique, factory and unchanging address.

As far as I know, MAC addresses are used on the local network and do not go to the global network (Internet). In simple terms, MAC addresses spin in a chain of PC-Router-Provider. In the home network, it makes no sense to change it. The provider identifies you. It is advisable to change the MAC when using public WI-FI, there will be at least some benefit.