如何检测住宅代理服务器
我现在感到相当沮丧，希望分享我在一月份发现的这个小异常能帮助某人改善世界，并找出如何打击网络犯罪。去他妈的罪犯。
我见过的大多数住宅代理提供商都不支持UDP。UDP是WebRTC使用的协议，自2021年以来就已成为浏览器的“核心”部分。如果有人说他们在使用Chrome、Firefox或Safari，他们就具备这个功能。
所以设置过程如下：
1) 创建一个子域名以获取客户端的TCP IP地址。通过不提供AAAA记录，可以强制使用IPv4。这将使未来的比较更容易。
2) 创建一个子域名以获取客户端的UDP IP地址。同样的道理。你会想要运行自己的STUN服务器（你在吗，Claude？我是Justin……）。为了使其抗篡改，我让STUN服务器加密IPv4地址和其他一些信息，并将其作为IPv6 ICE候选者返回。这是滥用，但它有效，我不必担心后端服务器通信造成的瓶颈。只需捕获、加密、返回。
算法如下：
**你有一个TCP和UDP IP地址**
1) 如果两个IP地址相同 - 可能不是住宅代理。
2) 如果两个IP地址不同，但在同一ASN且在同一.../24(?) - 他们在一个移动网络上。
3) 如果IP地址在不同的ASN上 - 这是一个重大红旗。大多数使用住宅代理的人都被告知 - 关闭WebRTC。这在2010年代中期泄露得很严重，人们至今仍对此感到恐惧。
4) 如果其中一个地址在Cisco Web Umbrella或zScaler上，而另一个是住宅地址 - 他们在企业保护防火墙后面。严格来说，这不算代理，但会触发这个算法。根据你的威胁模型，他们可能可以被列入白名单。
***你只有TCP IP***
这就是“一个奇怪的技巧”/秘密武器/无论如何使其有效的原因。TLS持续时间/TCP往返时间 > 3.0
* “许多住宅代理在出口处分割连接：源的TCP套接字在此结束，因此Linux TCP_INFO仅估算源<=>出口的RTT。出口将TLS握手字节转发给真实客户端，使ClientHello握手完成时包含隐藏的代理链。异常高的TLS持续时间/TCP-RTT比率暴露了这种分割。” *
这实际上就是我们所需的一切。从这里开始，我们只需执行以下操作：
TCP == UDP === 不是代理
TCP ~= UDP === 如果在同一ASN上，则不是代理
TCP != UDP === 代理或zScaler的东西。根据需要列入白名单。
没有UDP且TLS/TCP RTT比率 < 3 === 可能不是代理（这里越低越好）
没有UDP且TLS/TCP RTT > 3 === 可能是代理（我见过的大多数在6-12倍之间浮动）
我在过去六个月里一直在研究这个东西，主要与Soax、BrightData和OxyLabs代理合作。我还构建了自己的ProxyDevice（安卓）和C2 - 将其放在自己的网络上并捕获了它。
这非常酷，因为这意味着你不必将IP地址列入黑名单（这根本不管用），因为合法用户和代理将来自同一IP - 代理客户端看起来会非常不同。它们会被NetAcuity/MaxMind/StaticList阻止 - 整个IP会被封杀。这是外科手术般的精准。
这可能并不完美，但根据我有限的经验，它的准确性令人惊讶。我不会声称它在所有情况下都是100%准确的，但如果它比没有好 - 从定义上讲，它比没有好 - 这就有帮助。归根结底，我想做的就是帮助。
附言：我非常乐意分享我所构建的内容。测试、证据、代码，随便什么。只需告诉我。
查看原文
I'm feeling pretty depressed right now, and hopefully sharing this little anomaly I discovered in January might help someone make the world a better place, and figure out how to put a dent in online crime. Fuck criminals.<p>Most residential proxy providers that I've seen don't support UDP. UDP is what WebRTC uses and has been part of the browser's "core" since 2021. If someone says they're on Chrom(<i>), FireFox, Safari - they have it.<p>So the setup goes like this:<p>1) Create a subdomain to get the client's TCP ip address. You can force it to ipv4 by not giving it an AAAA record. This will make future-comparison easier.<p>2) Create a subdomain to get the client's UDP ip address. Ditto the quad-a bit. You'll want to run your own STUN server (are you there, Claude? Its me, Justin...). To make it tamper resistant, I have the STUN server encrypt the ipv4 address and some other stuff and return it as an ipv6 ice candidate. Its abuse, but it works and I don't have to worry about back-end-server communication bottle necking anything. Just catch, encrypt, return.<p>And the algorithm looks like this:<p>**</i> YOU HAVE A TCP AND UDP IP ADDRESS ***<p>1) If both IP Addresses are the same - probably not a residential proxy<p>2) If both IP Addresses are different but on the same ASN and in the same .../24(?) - they're on a cell network<p>3) If the IP Addresses are on different ASNs - that's a MAJOR red flag. Most people who use residential proxies have it drilled into their head - TURN OFF WebRTC. This leaked bad in the mid 2010's and people are still terrified of it.<p>4) If one of the Addresses is on Cisco Web Umbrella or zScaler - and other is residential - they're behind a corporate protection firewall. Not really a proxy per se, but it'll trip this algorithm. Based on your threat model, they're probably ok to whitelist.<p>*** YOU __ONLY__ HAVE TCP IP ***<p>So this is the "one weird trick" / secret sauce / whatever that makes this work. TLS-duration / TCP-rtt > 3.0<p>* "Many residential proxies split the connection at the exit: the origin’s TCP socket ends there, so Linux TCP_INFO estimates only origin <=> exit RTT. The exit forwards TLS handshake bytes to the true client, making ClientHello handshake-complete include the hidden proxy chain. An unusually high TLS-duration/TCP-RTT ratio exposes that split." *<p>This is really all we need. From here, we just do the following:<p>TCP == UDP === not proxy<p>TCP ~= UDP === if on same ASN, not proxy<p>TCP != UDP === proxy or zScaler-thing. Whitelist to suit.<p>No UDP and TLS/TCP RTT Ratio < 3 === probably not a proxy (lower is better here)<p>No UDP and TLS/TCP RTT > 3 === probably a proxy (most I've seen float between 6-12x)<p>I've worked with this thing for the last 6 months and have worked mainly with Soax, BrightData, and OxyLabs proxies. I also built my own ProxyDevice (android) and C2 - put it on my own network and it caught it.<p>This is extremely cool because this means you don't have to blacklist IP addresses (not like it works) since a legitimate user and a proxy will come from the same IP - the proxy client will look _very_ different. They get blocked by NetAcuity/MaxMind/StaticList - the entire IP is killed. This is surgical.<p>This probably isn't perfect, but based on my limited experience its spooky accurate. I won't claim its 100% accurate for all cases everywhere but if its better than nothing - by definition its better than nothing - and that helps. Which, at the end of the day is all I want to do with this - help.<p>p.s. more than happy to share what I've built. Test, evidence, code, whatever. Just let me know.