Welcome to the new TimYang.com

Sunday March 13

How to block anonymous surfing and anonymous surfers

I've had to upgrade the security of this website recently. Because of troll problems that have persisted over the years, I've had to take the drastic step of banning the trolls -- all of whom just so happen to be using Malaysian IPs. In addition to blocking all the ranges of the Malaysian universities and Malaysian ISPs, I've had to block anonymous surfing as well. The Malaysian IPs were easy enough to figure out using a combination of my counter and geo-IP location services like ip-to-country.com. Malaysians are notorious for not paying for anything online so I was concerned with free anonymous surfing proxies and have ignored the commercial ones.

There are several free anonymous surfing proxy IP lists on the internet which you can use with tools such as the Switch Proxy Toolbar for Firefox. Those are time consuming to block since the lists keep getting updated constantly. But it is more likely that most people will try using the anonymous surfing websites first. And those are easily blocked once you figure out the IP of the proxy server or servers.

1. Find the more popular anonymous surfing sites through a search engine like Google.
2. Then go to one of the surfing sites and visit an IP tracker site like whatismyip.com via the interface to determine the IP of that the anonymous surfing site uses to mask your own. The danger of using counters to perform this function is that they rely on cookies to determine visiting IPs and most (if not all) anonymous surfing websites don't load cookies so they remain completely unnoticed by counters.
3. Then edit your .htaccess file and add deny from followed by the IP number that you gained from the IP tracker. Here is an easy tutorial on how to block IPs using htaccess.
4. Repeat this process for as many of the anonymous surfing sites as you want. I did this for the sites listed in the first 100 results from Google. I think the Malaysians would give up trying long before they reach the end of that list.

For your convenience, here's a short list of the IPs of more popular anonymous surfing sites. These are only samples. These services usually use more than one IP (so you may have to indiscriminately ban a wide range like in the case of proxify.com).

1. Anonymization.com 70.84.56.170
2. The-cloak.com 62.132.1.121
3. Proxify.com 67.18.35.242, 67.15.77.116, 67.15.76.200 (etc etc)
4. Guardster.com 216.127.82.99
5. Anonymizer.com 168.143.113.125
6. Unipeak.com 207.234.129.8
7. Misterprivacy.com 66.225.241.61
8. Proxybuster.net 66.234.224.218
9. Webwarper.net 67.111.137.94
10. Surfeasy.info 67.18.185.50
11. Surffreedom.com 64.191.63.213
12. Proxyone.com 65.161.65.104

Comments

Tim:

If you have root access to a Linux box, you may want to consider my approach.

http://www.newestindustry.org/index.php/2005/03/11/blocking_anonymizer_hits

Thanks for the tip Stephen! Unfortunately, no, I don’t have root access to my box. But it’s an issue I’ll bring up with the sysadmins. This tip will only improve their security.

This is seriously good stuff Tim. Thanks for the tip.

The list of IPs I’ve tracked down for Proxify include the following class C ranges:
66.98.130.
66.98.131.
67.15.76.
67.15.77.
70.84.56.
168.75.65.

They host their service with EV1.net. While they may not use all of the IP addresses in the Class C ranges above, these IP ranges do contain IP addresses used by their service to connect to webservers and they are blocks of addresses dedicated to web hosting as opposed to EV1’s dialup service.  As such there should be a very minimal risk of blocking users who are not using the proxify service.

The most annoying thing about their service is that while they are allowing all users to block ads from websites, they are at the same time displaying their own ads on proxied pages served to non-paying users.  In otherwords they take our ads out and put their ads in.

This act of removing our ads and putting their ads in alone is reason enough to block this proxy service from accessing our sites.

Thanks Vinnie, nice stuff! It’s hard to track proxify because they use huge ranges.

Trackback URL for this entry