Usage example:
has(profiling.proxy_signals, 'TIMEZONE_MISMATCH')
Proxy Detection
profiling.proxy_probability
Gives probability between 0 - 1 of proxy being used.
profiling.proxy_type
Assigned category for what type of proxy.
RESIDENTIAL_PROXY
TRANSPARENT_PROXY
DISTORTION_PROXY
ANONYMOUS_PROXY
DATACENTER_PROXY
profiling.proxy_signals
Underlying signals giving evidence of proxy.
| Signal | Description |
|---|---|
| TIMEZONE_MISMATCH | Time-zones from ipinfo and javascript do not match |
| FORWARDFOR_EXISTS | ForwardFor Header exists implies confirmed presence of proxy |
| SLOW_CONNECT_SEQUENCE | Round-trip time of TCP packets are larger implying decent chance of proxy |
| TOO_SLOW_CONNECT_SEQUENCE | Round-trip time of TCP packets are much larger implying high proxy probability |
| WEBRTC_MISMATCH | WEBRTC and PRIMARY IP do not match; often correlates with proxies |
| DISTORTION_PROXY | ForwardFor and Primary IP do not match |
| DATACENTER_PROXY | IP address associates with a datacenter |
| ANONYMOUS_PROXY | No Forward Header was found |
| TRANSPARENT_PROXY | ForwardFor and Primary IP match |
| RESIDENTIAL_PROXY | TCP usage type is residential |
VPN Detection
profiling.vpn_probability
Gives probability between 0 - 1 of VPN being used.
profiling.vpn_signals
Underlying signals giving evidence of VPN.
| Signal | Description |
|---|---|
| TIMEZONE_MISMATCH | Time-zones from ipifo and javascript do not match |
| MTU_EXCEEDS_PROBE | Probe is smaller than gateway size. Indicates high probability of no VPN |
| LOWER_MSS | Max Segment Size: Lower value indicates higher VPN chance |
| NORMAL_CONNECT_SEQUENCE | Round-trip time of TCP and gateway packets are normal implying little chance of VPN |
| SLOW_CONNECT_SEQUENCE | Round-trip time of TCP and gateway packets are larger implying decent chance of VPN |
| TOO_SLOW_CONNECT_SEQUENCE | Round-trip time of TCP and gateway packets are much larger implying high VPN probability |
| WEBRTC_MISMATCH | WEBRTC and PRIMARY IP do not match; often correlates with VPN |
| LIKELY_VPN | proxy.vpn_probability > 0.7 |
| NORDVPN | VPN Client |
| PROTONVPN | VPN Client |
| AWSVPN | VPN Client |
Datacenter Classification
profiling.tcp.signals
AKAMAI
AMANAH
AMAZON_AWS
ANEXIA
AOL
APPLE
APTUM
ATLANTICMETRO
AVANTEHOSTING-NET
AWKNET
AXCELX
BACLOUD
BLIZZARD
BROADRIVER_INC
CABLEVISION
CANACA-COM_INC
CANADA_WEB_HOSTING
CARONET
CHARTER
CHOOPA
CISCO
CLOUDATCOST
CLOUDFLARE_INC
CLOUDROUTE
CLOUVIDER
COLOCATION_AMERICA_INC
COLOCROSSING
COLOSTORE
CYBERZONE_SA
DATABASE_BY_DESIGN
DATACAMP
DATASOFT_NETWORKS
DEDIPATH
DIGITALOCEAN
DOTSTER-COM
EHOSTINGUSA
EMBARQ
ENERGY_GROUP_NETWORKS
ENZU_INC
EPICUP
EZZI_NET
FASTLY_INC
FEVVO_INC
FIREWALL_BLACKLIST
FORK_NETWORKING_INC
GEARHOST
GLOBAL_BA
GLOBALTELEHOST
GODADDY
GOOGLE
GOOGLE_CLOUD
H4Y
HEFICED
HETZNER_ONLINE
HIGHSPEEDWEB_NET
HOPONE
HOST_DEPOT
HOSTIRIAN
HOSTROYALE
HOSTSTORE-COM
HOSTVENTURES
HOSTWAY
HURRICANE_ELECTIC
IBM
IBM_CLOUD
INPUT_OUTPUT_FLOOD_LLC
INTERNAP-COM
IOMART_HOSTING_LTD
JOOST
JOYENT_INC
KVCHOSTING
LATITUDE_SH
LEASEWEB
LIMESTONE_NETWORKS
LINDEN_LAB
LINK11_GMBH
LINKEDIN
LINODE
LOGICWEB_INC
M247
MICFO-COM
NETPROTECT
NEXEON_TECHNOLOGIES
NODESDIRECT
NORDVPN
NVIDIA
OPERASOFTWARE
OVH
PACKETHUB_SA
PAIR_NETWORKS
PALOALTONETWORKS
PANQ
PEAK_WEB_HOSTING
PEAK10
PERFORMIVE
PLUSSERVER
PSYCHZ_NETWORKS
QUADRANET
RACKSPACE
RAZOR
RELIABLE_HOSTING
ROYA_HOSTING
SERVERAXIS
SERVERCENTRAL
SERVERHUB
SERVERMANIA-COM
SERVERSPACE_LIMITED
SILICON_VALLEY_WEB_HOSTING
SPRINT
STACKPATH_LLC
STEAM
SUBNETLABS
SUDDENLINK
SURFSHARK
TERRATRANSIT_AG
THGINGENUITY
THORN-NET
TWC
TZULO_INC
UNSUBSCRIBE_BLACKLIST
USDEDICATED
VELCOM
VELIA
VERSAWEB
VIVID-HOSTING
VULTR
WEB_COM
WEB2OBJECTS
WHOLESALE_INTERNET_INC
WORLDSTREAM
XMISSION
YOURCOLO
ZENLAYER
ZSCALER_INC