Hacker News

points by anpat 3 days ago | 0 comments

How would one detect this on their home network and protect themselves from?

Step one, find your public IP, I like ipinfo.io but there are many other services that will show it. Then pop it into a tool like the one that's hosting TFA[1]

1: https://layer3intel.com/context

[–] therein 3 days ago

There is also iphub.info and iphunter.info.

In my experience, out of the two, iphunter.info has the more comprehensive database, I think the owner/operator frequents HN.

[–] EvanAnderson 3 days ago

Unexpected traffic would be the biggest gross red flag. If it constrains itself to moving traffic when it's otherwise perform its desired function (if it's one of those "free TV" boxes and it only proxies when you're playing video) it might be hard to tease-out the unwanted traffic purely looking at bytes in/out.

Beyond that gross metric you're getting into capturing traffic and decoding it.

[–] reincoder 2 days ago

Visit: ipinfo.io/my

If your IP address is part of a residential proxy network, it will be flagged.

Also, I recommend seeing the device count data we have for you. If you are on a NATed IP, you have virtually no control to remove the residential proxy SDK from your system. Let me know if you have any questions, as I work for IPinfo.

[–] tom1337 3 days ago

Check network traffic from smart devices would be a good start. If your TV does gigabytes of traffic in the night when you don’t use it, it most likely is acting as a residential proxy.

[–] reincoder 2 days ago

I work for IPinfo. Traffic data alone is not going to be a good indicator, to be honest. Last time I checked, we recognized 100 million resproxy IP addresses, and resproxy services charge by bandwidth. No single organization can or will want to run continuous operations from a single IP address, as it will get flagged by a non-IP-based bot detection check, and churning IPs generally indicate a standard web scraping operation.

I recommend folks just check our website: https://ipinfo.io/my and if they have questions, ask me, I will try to get to the bottom of this.

What we do is connect to residential proxy IP address and verify them before putting them in our database.

But DNS and traffic monitoring is a good practice. If you see gigabytes of traffic without explanation, you have more serious concerns than resproxy.

[–] mrguyorama 2 days ago

Don't buy any gadget that connects to a network. None.