How to tell between a Proxy IP or not!

[twinz]

Hello guys, I'm new here!

I'm having a problem on my site at the moment...The site is a Livejournal community that is locked to members-only, but a girl that was previously harassing me (and who was banned) has been finding ways to sneak on and continue the harassing anyway! She's made several different accounts to get in and, though I know her normal IP, the IPs on these keep changing! I think they are proxy IP addresses, but I'm not sure.

When using http://ipchecking.com/, whenever I type an IP address in that I know is real, it gives me the following information:

General information on **.238.207.**:

IPv4 address: **.238.207.**
IPv6 address: ::ffff:63ee:cf1b
Host name: CPE000bdbb9dfde-CM0019475745f2.cpe.net.cable.rogers.com
Reverse DNS: CPE000bdbb9dfde-CM0019475745f2.cpe.net.cable.rogers.com
Country: Canada
City: Toronto, ON

RBL (Real-Time Blocking List) lookup on **.238.207.**:

SPAMCOP: Not Found
SBL: Not Found
XBL: Not Found
CBL: Not Found
NJABL: Not Found
SORBS: Not Found
SURBL: Not Found

Whois information on **.238.207.**:

Rogers Cable Communications Inc. ROGERS-CAB-99 (NET-99-224-0-0-1)
99.224.0.0 - 99.255.255.255
Rogers Cable Inc. BASP HSI (NET-99-238-206-0-1)
99.238.206.0 - 99.238.207.255

CustName: Rogers Cable Inc. BASP
Address: 1 Mount Pleasant Road
City: Toronto
StateProv: ON
PostalCode: M4Y-2Y5
Country: CA
RegDate: 2009-03-03
Updated: 2009-03-03

NetRange: 99.238.206.0 - 99.238.207.255
CIDR: 99.238.206.0/23
NetName: HSI
NetHandle: NET-99-238-206-0-1
Parent: NET-99-224-0-0-1
NetType: Reassigned
RegDate: 2009-03-03
Updated: 2009-03-03

RTechHandle: IPMAN-ARIN
RTechName: IP MANAGE
RTechPhone: +1-416-935-4729
RTechEmail: ipmanage@rogers.wave.ca

OrgTechHandle: IPMAN-ARIN
OrgTechName: IP MANAGE
OrgTechPhone: +1-416-935-4729
OrgTechEmail: ipmanage@rogers.wave.ca

However, if I type in the IP address of a person I suspect to be using a proxy, I get this:
eneral information on 81.243.**.**:

IPv4 address: 81.243.**.**
IPv6 address: ::ffff:51f3:4161
Host name: 97.65-243-81.adsl-dyn.isp.belgacom.be
Reverse DNS: 97.65-243-81.adsl-dyn.isp.belgacom.be
Country: BELGIUM
City: Antwerpen

RBL (Real-Time Blocking List) lookup on 81.243.**.**:

SPAMCOP: Not Found
SBL: Not Found
XBL: Not Found
CBL: Not Found
NJABL: Not Found
SORBS: Listed in Spam and Open-Relay Blocking System (dnsbl.sorbs.net)
SURBL: Not Found

Whois information on 81.243.**.**:

inetnum: 81.243.64.0 - 81.243.79.255
netname: BE-SKYNET-ADSL1
descr: ADSL-GO-PLUS
descr: Belgacom ISP SA/NV
country: BE
admin-c: SN2068-RIPE
tech-c: SN2068-RIPE
remarks: rev-srv: ns1.skynet.be
remarks: rev-srv: ns2.skynet.be
remarks: rev-srv: ns3.skynet.be
remarks: rev-srv: ns4.skynet.be
status: ASSIGNED PA
mnt-by: SKYNETBE-MNT
mnt-by: SKYNETBE-ROBOT-MNT

role: Skynet NOC administrators
address: Belgacom SA de droit public
address: ANS/ROC/RNO/IEC - TGX Building
address: Boulevard du Roi Albert II, 27
address: B-1030 Bruxelles
address: Belgium
phone: +32 2 202-4111
fax-no: +32 2 203-6593
abuse-mailbox: abuse@skynet.be
admin-c: BIEC1-RIPE
tech-c: BIEC1-RIPE
nic-hdl: SN2068-RIPE
remarks: ******************************************
remarks: Abuse notifications to: abuse@belgacom.be
remarks: Abuse mails sent to other addresses will be ignored !
remarks: ******************************************
remarks: Network problems to: noc@skynet.be
remarks: Peering requests to: peering@skynet.be
mnt-by: SKYNETBE-MNT
source: RIPE
route: 81.240.0.0/14
descr: SKYNETBE-CUSTOMERS
origin: AS5432
mnt-by: SKYNETBE-MNT
source: RIPE


See? The Whois information is very unspecific.... It's as though the checker can't pinpoint the location because the address is jumping around. Does that make sense? I hope someone can confirm if this is a proxy or not...I just want to get rid of this girl who keeps bothering my site!

Thanks for your time!

[dirtyc]

Theres nothing unspecific about that 2nd set of whois data. It's clear that that IP (I'm assuming this one of the IPs she used) is in Belgium.

Do you know for sure that this person lives in North America?
If so, then yes, she is definitely using a proxy.

I'm fairly new to this game so I'll hope someone will correct me if I'm wrong. But I'm afraid that as long as she is smart enough to clear her browser of all cookies for your domain and to change her IP address each time she wants to bug you, then I don't think theres anyway to keep her off.

You can of course delete whatever she puts on there almost as soon as it goes up. But in terms of an automated rule to figure out its her and block her - lets put it this way - not any way that I know of.

Good luck. I hope someone else who knows more has more ideas.

---

(01-17-2010 06:45 AM)twinz Wrote:  It's as though the checker can't pinpoint the location because the address is jumping around.

I'm not sure what you mean by that ("the checker can't pinpoint").
If by "the checker" you mean the whois database, then yes you are correct - the checker can't pinpoint the location. The only thing it can do is tell you where an IP address geographically resides and who it belongs to when you supply it with an IP address to lookup.

What it can't do is tell you whether any given IP address is a "proxy IP" or a "normal IP" - partially because there is no such thing.
Proxy is a relative term.
For you, your home computer's ISP provided IP address is a "normal IP".
But, if I connect to your computer first for all of my internet browsing then for ME, your IP is a "proxy IP" - make sense?

[hellsinky]

need latest id address now

---

sorry ip

[jackportd]

Hello friend

I familiar[/u] with some proxy ip here is the

Doubleprotection.info/
needprivacy.info/
yourproxy.eu
proxyboot.net

Its a used by my friend and many one in the market.
If i found many then i post that here.

[sarangi]

No matter what I change it to, that NS19.NSHOSTER.net keeps overwriting an NS that i set. What's wrong? When i try to delete with WHM.You can also go throuh this get the updated one.