Proxy Detection

Inspects forwarded headers injected by proxy servers to trace the original client IP and flag anonymity attempts.

• X-Forwarded-For (XFF): Parses the leftmost originating IP in the chain; mismatches or internal IPs indicate spoofing.
• Via Header: Identifies the proxy software version (e.g., Squid, HAProxy) explicitly declared by the intermediary.
• Proxy-Authorization: Presence of this hop-by-hop header signals a forward proxy connection.
• Cache Headers: Anomalous X-Cache or CF-Connecting-IP values can reveal CDN or reverse proxy traversal.

Cross-references the connecting IP against commercial databases to detect inconsistencies between declared and actual origin.

• ASN Lookup: Identifies if the IP belongs to a hosting provider (AWS, DigitalOcean) rather than a residential ISP.
• Timezone vs. Browser: Compares the IP timezone against the browser's Intl.DateTimeFormat().resolvedOptions().timeZone; a delta signals a remote proxy.
• Language Mismatch: Detects when Accept-Language headers conflict with the IP's geographic locale.
• Bogon Filtering: Blocks traffic from unallocated or reserved IP space often used in proxy testing.

Analyzes passive OS signatures at the transport layer to identify the true originating system behind the proxy.

• TTL Analysis: Measures the initial Time-to-Live value; a Linux proxy forwarding Windows traffic exhibits a distinct TTL decrement pattern.
• TCP Window Size: Identifies the OS kernel through its specific initial congestion window (e.g., Linux 2.6 vs. Windows 10).
• MSS & Options Order: The Maximum Segment Size and the ordering of TCP options (SACK, Timestamp) create a unique stack signature.
• JA4+ Hashing: Generates a fingerprint of the TLS Client Hello, including cipher suites and extensions, to identify the proxy client software regardless of IP rotation.

Actively scans the connecting IP for exposed services that definitively classify it as a proxy exit node.

• SOCKS5 (1080): An open SOCKS port confirms the IP is acting as a generic TCP proxy.
• HTTP Proxy (3128/8080): Standard ports for Squid or generic HTTP forward proxies.
• VPN Endpoints (1194/51820): OpenVPN or WireGuard ports indicate a VPN exit node rather than a standard forward proxy.
• DNSBL Integration: Queries real-time DNS-based blocklists (DNSBLs) like Spamhaus XBL or EFnet RBL that aggregate known proxy and compromised host IPs.

Uses timing side-channels to infer the presence of an additional routing hop between the client and the detection server.

• TCP Handshake RTT: Measures the round-trip time of the SYN/SYN-ACK exchange; a proxy adds a measurable latency delta.
• Traceroute Correlation: Compares the network path; a sudden jump from a residential ISP hop to a data center AS signals a proxy boundary.
• HTTP/2 Multiplexing Anomalies: Detects when stream prioritization and flow control windows behave inconsistently with a direct browser connection.
• Clock Skew: Measures microscopic TCP Timestamp option offsets to fingerprint the physical machine behind the proxy.

Queries proprietary threat intelligence platforms that maintain real-time registries of known proxy exit nodes and VPN services.

• IPQualityScore / MaxMind: Provides a probabilistic proxy score based on traffic patterns, blacklists, and machine learning models.
• VPN Exit Node Lists: Maintains dynamic catalogs of IPs operated by commercial VPN providers (NordVPN, ExpressVPN) and residential proxy networks (Luminati, GeoSurf).
• TOR Exit Node Enumeration: Downloads the publicly available list of active TOR exit relays from the official TOR Project directory.
• Confidence Scoring: Returns a structured risk score (0-100) rather than a binary flag, allowing for graduated responses like CAPTCHA challenges instead of hard blocks.

A network security technique that cross-references connecting IP addresses with databases of known Virtual Private Network exit nodes to block users attempting to mask their true geographic origin. VPN detection shares significant overlap with proxy detection, as both rely on IP metadata analysis and commercial threat intelligence feeds. Key indicators include:

• ASN belonging to major hosting or VPN providers
• Discrepancy between IP geolocation and browser-reported location
• Presence on public VPN blocklists
• Traffic patterns inconsistent with residential ISP behavior

The identification of traffic originating from cloud hosting providers and server farms rather than residential ISPs, a strong heuristic indicator of automated scraping infrastructure. Unlike proxy detection which identifies intermediary servers, data center IP detection focuses on the origin network type. Commercial proxy services frequently route traffic through data center IP ranges from providers like AWS, DigitalOcean, and OVH. Detection methods include:

• ASN lookups against known hosting provider databases
• Reverse DNS analysis for cloud provider hostnames
• IP range registration data from RIRs

A scoring mechanism that evaluates the trustworthiness of an IP address based on historical behavior, threat intelligence feeds, and association with malicious activities to inform blocking decisions. Proxy detection feeds directly into IP reputation systems—an IP identified as a proxy exit node receives a lower reputation score. Reputation databases aggregate signals including:

• History of credential stuffing or scraping attacks
• Association with known botnets
• Frequency of appearance across honeypot networks
• Age and stability of the IP assignment

A passive identification technique that analyzes the specific parameters of a client's Transport Layer Security handshake—including cipher suites, extensions, and elliptic curves—to identify the originating software or bot. While proxy detection examines network-layer metadata, TLS fingerprinting operates at the presentation layer to detect tooling signatures. JA4 hashes can identify:

• Specific Python requests library versions
• Headless browser automation frameworks
• Residential proxy client software
• Malware command-and-control agents

A comprehensive security discipline that uses machine learning, fingerprinting, and behavioral analysis to detect, categorize, and mitigate malicious automated traffic while allowing beneficial bots. Proxy detection serves as one signal within a bot management platform's risk scoring engine. Modern bot management combines:

• Proxy and VPN detection for network-layer signals
• Browser fingerprinting for client-side integrity
• Behavioral biometrics for interaction pattern analysis
• Challenge-response mechanisms for verification
• Ensemble ML models for real-time classification

A machine learning approach that establishes a baseline of normal traffic patterns and flags statistical deviations indicative of scraping activity. Proxy detection provides static signals, while anomaly detection identifies dynamic behavioral patterns that evade signature-based detection. Key metrics monitored include:

• Request rate distributions per session
• Navigation flow entropy and page transition probabilities
• Time-on-page and scroll depth patterns
• Geographic access pattern consistency
• API endpoint sequencing and parameter variation