17 ms·
How Is NordVPN Unblocking Disney+?
- IdontRememberIt 7y agoWe block vpns/open proxies. 99% of the time a user is complaining, their main argument is so they can have "a secure Internet connection" to our site.
- pteraspidomorph 7y agoI don't know what your business is, but I run my own VPN (closed). I will complain if you block it for no apparent reason, because you are forcing me to interrupt a dozen connections and ongoing workflows if I want to use your service (usually I just won't).
- t0astbread 7y agoHow does your company handle these complaints?
- kyledrake 7y agoIt seems that the author is getting a different IP from NordVPN each time they make a request. Does that mean Disney could block this by preventing the request from coming from another IP each time a request is made?
- Exuma 7y agoThat would block all "first requests" which wouldn't work
- kyledrake 7y agoAfter a logged in session, you could count the number of times an IP address changes, and if it changes more than 3 or something in the last 10 minutes, it's a good sign that they're using some sort of malware VPN.
- aflag 7y agoOr that they could be walk around the city and connecting to different wifis or maybe the person's connection is poor and keeps dropping and reconnecting. I'm sure there are plenty other legitimate use cases where the IP changes frequently. Also, bear in mind that blocking people from using it is not in disney+ interest. They do it just so they can prove in court they are following the copyright agreements they have. But if someone "hacks" the system, they are not incentivised to put in resources to fix the hacks so they can have less paying costumers.
- derefr 7y ago> Does [Oxylabs.io’s distribution] mean your device can be used by a third party to access child porn or hack into a bank? Absolutely! I mean, isn’t the existence of Oxylabs a boon for everyone’s privacy—in the sense of making everyone’s actions deniable/repudiable? Oxylabs introduces reasonable doubt for every possible allegation of cybercrime! “It wasn’t me; it was this botnet malware routing through my computer without my knowledge!” It’s like having a Tor exit node on your computer, without the associated mens rea that would come from the explicit choice to install one!
- rtempaccount1 7y agoIn theory sure. In practice (especially if you don't know your connection is being used like this, as the article suggests), if law enforcement turn up at your door to take all your kit as evidence in a crime, they'll likely take all your kit for an extended period of time (and possibly charge you) until/unless you can prove that it wasn't you that sent the traffic. There have been cases of this happening to ToR exit nodes and that was ones the operators could point to...
- o-__-o 7y agoNo you can easily prove it wasn't you that sent the traffic, simply look at case law for all of the torrenters absolved from having open wifi access points. The problem is your hardware is locked up in a criminal trial, which realistically means you ain't getting it back. And they're not just going for that device you used with a VPN, they're taking any possible device that connected to the VPN including routers, laptops, iphones, tablets, connected hard drives, etc. THAT is the reason why a rational actor won't use such a service.
- rtempaccount1 7y agoHow do you prove the traffic wasn't sent by you, if you don't know the software that was being used to hijack your connection was even installed?
- 7y ago
- streb-lo 7y ago> All the most common US ISPs are there… AT&T, Comcast, Verizon, CenturyLink. IPs from Charter Communications in their Midwest, Texas, Pacwest and Northeast regions. ISPs I’ve never heard of before… who the heck is Delcom? Turns out they are serving some rural communities in Texas. Did NordVPN buy servers or connectivity from them? I've been seeing a ton of these guys' advertising lately. If it turns out they're also reselling your bandwidth? Still, I'd like to see someone take a peek at their local client traffic for any suspicious activity before coming to any conclusion. Edit: I guess allegedly the 'botnet' aspect is provided not by other NordVPN users but by malware provided by companies associated with NordVPN.
- dewey 7y ago> If it turns out they're also reselling your bandwidth? Monetizing your free app through selling traffic is nothing new and there's a bunch of companies doing just that. You drop their SDK into your mobile app, they give you money and in return they get their very own "botnet".
- smolder 7y agoUsers should be upset that such trash is allowed on whatever stores they're hosted on.
- mikl 7y agoSeriously creepy stuff. I hate how VPNs are being shilled by e-celebs these days as a privacy improvement. It’s just using a different middleman. One middleman might be better than another, but if you have a good ISP already, there’s no privacy/security benefits to be had by using a VPN when surfing from home. It might be worth getting a VPN if you use sketchy WiFi often, or want to bypass geo-blocking or restrictive firewalls. But remember that you’re trusting the VPN provider with all your traffic. DNS is still not encrypted in most browsers, so this traffic is still a goldmine of marketable info. Sure, they can’t see what you post on snapstagram.com or what pages you visit on news.ycombinator.com, but they can infer a lot about your browsing habits from DNS queries.
- gambiting 7y agoFriendly reminder that in the UK all ISPs are required by law to keep your entire browsing history for a year, and that history can be accessed by few dozen agencies, warrant free. That's why I use a VPN personally.
- stjohnswarts 7y agoExactly, they're generally more trustworthy than most governments. Security is about probability and is never 100%.
- ludjer 7y agoIf you only use HTTPS they can track your DNS queries but they cant track anything other then that. When you do a google for something so let us say google.com?search=searchTerm they see a dns lookup for google.com. They will not see ?search=searchTerm or anything else. They will see a connection open between your computer and another IP after that. In the future that will stop becoming a problem because there will be DNS over TLS or DNS over HTTPS which will even hide your DNS lookups. Which means all the ISP will see is you made a TCP connection to X. Theoretically they could just do a reverse lookup for that IP but that is not always easy.
- My1 7y agoExcept that they cant really get your browsing history. Just the domains you used. At least on the 90% of https sites most ppl visit
- trymas 7y agoRing ding ding ding. Jackpot. I had on my backlog to do something similar, I guess I do not have to. NordVPN is just a front for Tesonet to gather data and sell your bandwith for bots, scrapers etc. through OxyLabs and other companies.
- NeaterPeter 7y agoThis article doesn't really make a lot of sense as there's no hard proof, just speculations of the author
- mikl 7y agoNo smoking gun, sure, but some very suspicious traffic patterns. How is NordVPN getting traffic routed through so many different ISPs who generally only serve residential customers? Hard to imagine that so many ISPs are agreeing to help NordVPN bypass geo-blocking. Pretty certain that there’s some kind of shenanigans going on.
- c256 7y agoI don’t have any experience with NordVPN, but off the top of my head, it’s not hard to imagine someone looking at an internet backbone map, doing some math, and just paying for a couple hundred residential broadband packages. (Napkin speculation: maybe 30 major markets, round up to 50. Most markets have only a couple serious residential broadband providers (sadly, in the U.S. the average is below 2), so multiply that by 3 (a big over-estimate, but in some places it’s probably worthwhile to double coverage). Sprinkle the remaining 50 around the smaller markets to make sure you have decent access into all of the major backbone loops. Ballpark it at $50/each and you could blanket the U.S. major population centers for $1k/month.)
- jsjohnst 7y agoThe ISP bill is only part of the overall cost, and a small piece of it at that. You also need a physical address for that connection to be installed at, power for equipment, and someone to respond when something inevitably goes wrong (admittedly the person could cover multiple cities potentially).
- mirimir 7y agoYears ago, I knew a guy who wanted to do that with devices in used trailers. Managed by locally recruited "fake" residents, working as consultants. Located in trailer parks around the US. Seemed way too iffy to me.
- dewey 7y ago> Think of “residential proxies” this way: 1.) Oxylabs installs some malware on to a user’s device, unknown to the user, by bundling it with other software that the user downloads. 2.)This malware enables Oxylabs to sell off your bandwidth, your computing power, and your IP address to third parties, who will route their internet traffic through your device. There's so many providers doing something similar, it really isn't a Oxylabs / NordVPN exclusive issue. - https://luminati.io/residential_ips https://luminati.io/residential_ips - https://www.geosurf.com/blog/what-are-residential-proxies/ https://www.geosurf.com/blog/what-are-residential-proxies/ - http://stormproxies.com/residential_proxy.html http://stormproxies.com/residential_proxy.html - https://krebsonsecurity.com/tag/residential-proxies/ https://krebsonsecurity.com/tag/residential-proxies/ - https://multilogin.com/proxy/ https://multilogin.com/proxy/ - https://smartproxy.com/blog/what-is-a-residential-proxies-network https://smartproxy.com/blog/what-is-a-residential-proxies-ne... Based on my understanding it's people having free apps they want to monetize. They then implement a proxy company's SDK which enables this traffic sharing and get paid by them.
- dathinab 7y agoDid they consider that maybe all the clients are NordVPN customers, i.e your data will come from a different users internet connection but another users data comes from you. With that there world be no reason to have any hidden malware practice or similar, it _could_ even be in the terms of service if some of their products... I mean it's true that there is a lot of bs going one but before claiming them for having hidden malware you should make sure they do, instead of just saying "that's the only way it's possible' even if it isn't the only way.
- the_gipsy 7y agoThat's possible. The author jumped from residential IPs to malware without further checks.
- rtempaccount1 7y agoI don't believe that NordVPN make it clear that user's connections could be treated like that (e.g. as bandwidth for other customers) Unless they make that clear, it's not a great look.
- c256 7y agoNobody claims that NordVPN customer connections are being used for this; the claim is that they are probably using Oxylab, which is probably using Oxylab customer’s connections, which they are probably using via malware of some unspecified type, so the Oxylab users probably don’t know how their connection is being used. While some of those leaps of logic are plausible, it’s a lot of guessing.
- jesuisuncaillou 7y agoI thought the same thing. They could be using their legitimate user's connections. But even if they're rerouting traffic through their users, and if they wrote that in the terms of service, I doubt any of their users know they signed up for this. Which is not illegal, but still kind of sketchy. If it's hidden in their terms of service, but not explicitly written on the content the user actually reads while subscribing, I consider this very unethical.
- Havoc 7y agoI'm on the lookout for a black friday VPS deal. Between this a PIA's shady stuff I'm just gonna have to host my own. The commercial VPN scene is a cesspool.
- mikl 7y agoTooting my own horn a little, I recently wrote a short guide on setting up a home VPN, it’s working great for my needs: https://mikkel.hoegh.org/2019/11/01/home-vpn-server-wireguard https://mikkel.hoegh.org/2019/11/01/home-vpn-server-wireguar... :)
- gruez 7y agohome/vps hosted VPNs are only really helpful to mitigate malicious ISP (or hotspot operator). If need a VPN for identity hiding purposes (eg. torrenting, evading IP tracking), you still need a commercial VPN provider.
- mikl 7y agoOr bypassing firewalls and IP restrictions. But yeah, if you’re doing something illegal, obviously don’t use a home VPN, duh.
- stjohnswarts 7y agoThose are only good for VPN netflix or being more secure at coffee shops.
- 7y ago
- johnpowell 7y agoI'm somewhat shocked that residential connections have enough bandwidth to upload a streaming video as a proxy. But maybe people using a VPN for Disney+ are just glad it works at all. I have Comcast and my upload on a good day is 500KB/s and that cripples everything else on the network.
- phiresky 7y agoI'd guess they only proxy the main domains (which have the session cookies and probably the geoblocking criteria), but let the video serving domains (which at least in netflix are separate and "stupid") go through their normal network.
- johnpowell 7y agoThis makes sense. Thanks.
- Bombthecat 7y agoYeah, was wondering the same..
- driverdan 7y agoWhy is your uplink so bad? Do you have a low tier plan? If not, why haven't you had Comcast fix it?
- johnpowell 7y agoI have Comcast Business. I pay them 100 dollars a month. Even if I paid them way more they just don't offer much more upload where I live. They will give me tons of download but all their plans have anemic upload. My only other option is Centurylink and they will give me a symmetric line. But that tops out at 12Mbp/s. At least with Comcast I get a reasonable download. I live in a major metropolitan area. Five miles from where a NBA team plays home games.
- bscphil 7y ago
- lucb1e 7y ago> Then I decided to give NordVPN a try, and poof, it worked like a charm. How was this possible? Residential IPs was my guess. "Guess"? Do they route packets differently depending on the destination, i.e. if you go to one of the whatsmyip websites you'll see a nordvpn-owned IP but to a Disney server the use someone's home connection? Is that what the author says is happening here? I don't know if this is common but, while technically possible, it seems a little weird. I assume the author could just have checked what IP they were exiting from. Edit: someone else verified it, yes indeed they use residential IP addresses: https://news.ycombinator.com/item?id=21665084 https://news.ycombinator.com/item?id=21665084
- dd6d658 7y agoHadn't heard of akamai pragma headers before. Used the ones from https://support.globaldots.com/hc/en-us/articles/115003996705-Akamai-Pragma-Headers-overview https://support.globaldots.com/hc/en-us/articles/11500399670... and it dumped a bunch of other debug info https://pastebin.com/hteaGG6N https://pastebin.com/hteaGG6N wtf?
- c256 7y ago(This part of) Akamaiks value prop rests on two things: they have servers all over the world, and they can figure out which of those are both functioning well and (network-wise) close to you. The former comes from infrastructure investment and management. The latter comes from collecting and processing data from all over the (network-wise) world, quickly. That last part involves building and updating a map of actual and potential internet traffic — not quite all of it, but for everywhere that your (prospective Akamai customer ‘you’) customers might be. Doing _that_ without owning ~all of the BGP routers in the world plus ~all of the local ISPs in the world involves a fair bit of probing, data gathering, and a bunch of math. It’s likely that those headers don’t all get added all the time, for all the Akamai traffic, but instead are added selectively for key parts of the mapping process. (Disclosure: I worked for Akamai Way Back When, but left the company many years ago.)
- harrylucas 7y agoInteresting, I'm assuming that this wouldn't be possible on iOS devices? E.g. would installing a calculator app on iOS allow someone to route traffic through my phone? (obviously without me granting vpn access to said app).
- forgone 7y agoyeah why not? you just listen and rebroadcast data
- willstrafach 7y agoThis would indeed be possible, although slow, and only when the affected app is open.
- c256 7y agoTechnically possible, practically unlikely (you iOS phone would be a terrible router, giving the people who made the calculator app a slow, unreliable output node that would identify to the desired source as a lower-quality (mobile) client. In other words, it would be a bunch of extra work and risk for a worse result. The theoretical model here is using people’s fast, stable (-ish) broadband connections to relay the connection. Even then, it’s only for the initial setup steps; once you get to the actual streaming data, nobody in this model wants to ferry those packets around.
- smolder 7y agoGetting around geoblocking probably doesn't require the main video streaming connection to be through one of these IPs.
- kitcar 7y agoWouldn't this be pretty easy to confirm by monitoring bandwidth consumption on a dormant computer running NordVPN? If bandwidth consumption is exponentially higher when their VPN client is enabled, then clearly they are passing traffic through your machine...
- dna_polymerase 7y agoThat is not how this supposedly works. The Oxylabs people (according to the author) put software out there (like Apps, or Installers whatever) and those are infected. That's why it's hard to proof this, first link those gnarly apps to oxylabs, next link oxylabs to NordVPN. This is how it could be done: Rent Oxylabs Residential IP's (600$ minimum commitment, according to [0]). Check out IPs, stop using them, hope they get rotated to NordVPN, where you'd have to monitor the ips used. At Oxylabs pricing the only possible conclusion if a match was found would be that the services are intertwined. [0]: https://oxylabs.io/pricing/residential-proxy-pool https://oxylabs.io/pricing/residential-proxy-pool
- dalemyers 7y agoWhat am I missing here? Surely if this were true, Nord would be able to unblock basically every service. Netflix, prime video, etc. Would all work. That's not the case though?
- ilaksh 7y agoI live in Mexico and use Nord VPN (or I did at least, seems like maybe I can't anymore unless I want my computer to be a proxy for arbitrary and potentially nefarious traffic). I have Amazon Prime Video, Disney+, HBO Now, Hulu, and Netflix. All work with Nord VPN running.
- mmd45 7y agoi let my kids download apps on ios and chromeos (no android). is it technically possible for these apps to be proxying data for someone like nord? if so, would it only be while the apps are in the foreground or can they do it in the background?
- deleted 7y ago[deleted]
- smolder 7y agoYes. As stated elsewhere this is Oxylabs' business model and it's how a decent number of free apps monetize. I don't know how relevant background/foreground are.
- Haga 7y agoAh, surely it's not the continuous streaming that poisons all the vpns in China.
- oefrha 7y agoHaving used one of these shady proxy pool services once in the past for some (pretty harmless) scraping (not especially proud of it), I seriously doubt a service like that is good enough for video streaming. Usually half of the proxies in the pool are high ping or unreachable, and the other half are only valid for at most a few minutes. Maybe I just didn’t pay enough for the gold tier or something. Edit: Another comment pointed out that maybe only the front domain is geoblocked, but not the video CDN domains. That would make sense. Now that I think about it, youtube-dl also has a --geo-verification-proxy option that works in the same way.
- stordoff 7y agoAssuming a direct business relationship, there's no reason they couldn't hand-pick or filter out the good hosts, and then put the rest in the general pool.
- brianpgordon 7y agoIt works perfectly for me. https://i.imgur.com/PFITtZT.png https://i.imgur.com/PFITtZT.png
- Spy520 7y agoHe wasn’t talking about NordVPN speeds. He was talking about the sort of services offered by Oxylabs, Honeygain, PacketStream and other similar proxy services.
- brianpgordon 7y agoWell isn't the whole article asserting that NordVPN is routing traffic through residential endpoints to confuse would-be VPN blockers? I thought that the allegation is that there's no distinction between the Oxylabs network and the NordVPN service.
- oefrha 7y agoThe allegation is that they use a Oxylabs-like service for disneyplus.com specifically. Your speed test result using a Total Servers Solutions LLC connection to a non-disneyplus.com destination is irrelevant to that allegation.
- bigfuz 7y agoAny open-source OpenVPN client works just fine with NordVPN
- NelsonMinar 7y agoNo one's said this clearly so I will. oxylabs.io as described in this article is an awful unethical company and should be investigated for criminal activity. If NordVPN is using them to bypass DRM controls, that's pretty ugly. The central concern is how they get their 32M "residential proxies". I spent a few minutes trying to get an answer and could not find one. The article straight up assumes it's coming from malware, which certainly seems possible. I could also imagine them buying legitimate access from ISPs but given the various legal and technical issues involved it seems less likely. Is there anything directly connecting Oxylabs to malware? Again I looked for a few minutes and didn't find anything clear. I did find a couple of troubling posts on Reddit from Android Devs saying Oxylabs approached them offering to "monetize your users with our SDK", which sounds like the slippery slope to malware. Or at least bundleware without meaningful consent. https://www.reddit.com/r/androiddev/comments/ajfc7w/question_about_oxylabs/ https://www.reddit.com/r/androiddev/comments/ajfc7w/question... https://www.reddit.com/r/androiddev/comments/ao27tu/my_app_with_1million_installs_and_100k_monthly/ https://www.reddit.com/r/androiddev/comments/ao27tu/my_app_w... BTW, Oxynet has a list of the ASNs they have proxies on: https://intro.oxylabs.io/hc/en-us/articles/360003444780-Supported-ASN-List https://intro.oxylabs.io/hc/en-us/articles/360003444780-Supp...
- berbec 7y agoIsn't it likely a non-zero percent of those residential IPs are from other NordVPN clients? Or anyone who installed their app on their device?
- bootloop 7y agoI would guess it's from services like the Hola VPN browser extension provides. It was always clear that these services need to make money somehow. Next to providing tunnels to their own users they will sell them to others. Not sure if this is really unethical.
- spyder 7y agoFrom the patent infringement document: "... Upon information and belief, the above OxyLabs embedded code has been integrated in at least the following software applications that may be downloaded by any user located anywhere having Internet access: AppAspect Technologies’ “EMI Calculator” and “Automatic Call Recorder”; Birrastorming Ideas, S.L’s “IPTV Manager for VL;” CC Soft’s “Followers Tool for Instagram;” Glidesoft Technologies’ “Route Finder;” ImaTechInnovations’ “3D Wallpaper Parallax 2018;” and Softmate a/k/a Toolbarstudio Inc.’s “AppGeyser” and “Toolbarstudio.”" https://cdn-resprivacy.pressidium.com/wp-content/uploads/2018/08/Luminati-Networks-LTD-vs-UAB-Tesonet.pdf https://cdn-resprivacy.pressidium.com/wp-content/uploads/201... Looking at few of these app's descriptions and privacy policy, doesn't mention anything about oxylabs or proxies, so I'm not sure it's true, but somebody should check the apps with decompiler or monitoring the connections it makes.
- ikeboy 7y ago>They promised they had nothing to do with Oxylabs, but now that assertion seems to be false. Only if you deliberately misread the post, which is clearly saying that NordVPN doesn't use its users' devices to route traffic, unlike HolaVPN. It doesn't say they don't use Tesonet services to route traffic. They're denying being a supplier to Tesonet, they're not denying being on the demand side.
- berbec 7y agoNot defending PIA, as they've been purchase by satan.net, but remember the HN posts where NordVPN was asked some very unfriendly questions by Private Internet Access? Remember everyone dismissing it as a astroturf marketing ploy? I've been a PIA customer, and am canceling to switch to Mullvad, but PIA selling out seems not to prove they weren't right before.
- Exuma 7y agoCan you tell me more about Mullvad, does it have a good reputation with HN/elsewhere? Does it have common VPN problems like leaking etc? I'm looking to switch away from Nord now.
- Exuma 7y agoOk, well fuck NordVPN. Can someone recommend something good that doesn't log, without setting up my own entire VPN (yes I get its the only way to be sure blah blah blah. I definitely care, but not enough to waste a week doing all that)
- ozzmotik 7y agoif you're wasting a week doing it, I'm fairly confident that you are doing something wrong. I set up an internal VPN on my home network for ad blocking purposes (cf. Pi-hole) and it literally took less than an hour, despite that being the first time I had ever really done such a thing. I think maybe you just need the right guide, or even something like the ansible playbook someone mentioned in a different comment that can just automate the process for you
- Exuma 7y agoI'm being super dramatic, even if it takes 1 hour the last thing I want is yet another server login floating around. If I were doing some serious stuff, I would do it, but I really use a VPN only when I'm at coffee shops and stuff to prevent random nonsense. I use a VPN to completely hide my tracks etc. With that said, I don't want my data to be sold to tensornet or whatever that crap company is called
- ozzmotik 7y agooh that makes sense. my apologies, I am not particularly good at picking up on subtext on the internet. I personally don't really use a VPN at all, no particular need to since I personally believe that online privacy is an illusion that the government and corporations created to have a problem they could market a solution for. Perhaps a little tinfoil hat-y but I'm entirely convinced that there's no amount of encryption or misdirection that nation state level intelligence agencies with absurdly high budgets (and likely the collaboration of other intelligence agencies) could not reverse engineer or work around.
- Exuma 7y ago
- eximius 7y agoIf anyone here knows enough about ASNs and the RIRs to set up a company whose sole purpose was for individuals to buy/lease IPs, I would gladly help set up and run such a company. The RIRs generally don't allow individuals to have ASNs, so I assume an intermediary like this would be necessary. But between uses like setting up a personal VPN with a clean IP or just the cool idea of having a personal IPv4 address or IPv6 block... I think it would be a viable, if rather small and niche, business.
- techdevangelist 7y agoI think the main catch would be this new ASN would become known by the very companies/services trying to ban non-consumer IP blocks. Providers like DigitalOcean, AWS, and Azure are non-eyeball networks, so you see more bots and geo-shifting users (nonUS users trying to avoid a geo block by Disney for example). Any IP announced by the ASN would be known by looking at the bgp announcement and listed/blocked. Hiding bots and other users among the huge Comcast & Spectrum IP blocks makes it harder for media companies to block them. It’s just how do you legitimately buy a bunch of consumer connections, or get users to install software to share their consumer connection, hence the NordVPN clients I assume.
- eximius 7y agoWhy would this ASN be classified as bots if it's meant to be for individuals? Granted, abuse can occur. But assume US-based with basic KYC or something so that most IPs might genuinely be nerds like me using it as their IP.
- U8dcN7vx 7y agoYou don't need a company to get an ASN, but you do need to show that you intend to get network connections from at least two providers and generally that mean planning which plans are generally required as proof. There are effectively no more clean IPv4 addresses, you'd have to buy addresses that had previously been used. Anyone can get IPv6 addresses even those whose ISP sucks via tunnelbroker.net (aka Hurricane Electric) which will provide a single address, also a /64 and/or a /48. Of course they are generally blocked by streaming services since they are a form of VPN and thus the endpoint might be anywhere.
- Nas808 7y agoAll of these commercial VPN providers seem a bit sketchy to me. Roll your own on a VPS with Algo.
- mathgenius 7y agoI don't know what this guy is doing with all this pragma stuff... Once you hook up to a NordVPN server the IP doesn't change... NordVPN has thousands of servers, I assumed that is why the content providers don't block them, because they can't keep up. Except amazon, which seems to be better at blocking than the others. Is this guy saying that these thousands of servers are not in some data center somewhere, but actually residential malware?I'm doing some tracepath'ing (not a network guy...) and I don't see what this guy is claiming. I'm calling bs.
- mirimir 7y agoI think that he's saying that the connection from the NordVPN server to Disney+ is getting proxied through residential IPs. But hey, I'm testing that now. Edit: Using IVPN's Germany exit ... $ curl -LIX GET https://www.disneyplus.com -H 'Pragma: akamai-x-get-client-ip' ... X-Akamai-Pragma-Client-IP: 178.162.222.41, 178.162.222.41 ... and ... $ w3m -dump https://ipchicken.com ... 178.162.222.41
- limond 7y agoI was testing this earlier with a NordVPN US server. Akamai sees a changing IP (different from the public IP of the server) that seems to be in residential ISP IP blocks when retrieving www.disneyplus.com. For other sites on the Akamai CDN this was not true. On other sites header and public IP matched like in your example.
- mirimir 7y agoInteresting. So their US exits must look at the target URL, and use a residential proxy if it's Disney+ (and perhaps, other juicy sites). I'm in the process of doing this for all 1537 of NordVPN's US servers.
- mirimir 7y agoDid you use the NordVPN client, or stock OpenVPN? And if the NordVPN client, what OS?
- Scoundreller 7y agoAh, I think Oxydata is behind the recently defunct Oxyleads.com which seemed to publish historical scraped LinkedIn data. They had a browser extension, maybe somebody can get a copy and see what's in common with other extensions? https://support.oxyleads.com/hc/en-us/articles/360015036112-Download-Browser-Extension https://support.oxyleads.com/hc/en-us/articles/360015036112-...
- EternalAugust 7y agoThey may be "residential IPs" but you can do an nmap scan on the IPs to see if there are any open ports. If there are no open ports then it's likely a residential IP because stateful firewalls on home routers. If there are open ports it's likely not a residential IP since some kind of port forwarding would have to be enabled, which most people don't do, or a DMZ would have to be set up (even less likely). I scanned a few of the IPs returned from the curl test. Granted a small sample size, but they all have open ports. Beyond the scan I didn't try to connect to any of them via browser or otherwise. Here is what I found for the "Delcom" IP he's so worked up about: ``` $ sudo nmap 76.77.25.75 Starting Nmap 7.70 ( https://nmap.org https://nmap.org ) at 2019-11-29 19:21 EST Nmap scan report for static-76-77-25-75.networklubbock.net (76.77.25.75) Host is up (0.097s latency). Not shown: 992 closed ports PORT STATE SERVICE 22/tcp filtered ssh 23/tcp filtered telnet 25/tcp filtered smtp 53/tcp filtered domain 80/tcp open http 443/tcp open https 5060/tcp open sip 8080/tcp open http-proxy Nmap done: 1 IP address (1 host up) scanned in 331.02 seconds ``` Maybe I'm missing something here. Of course it could still be malware, but that's far from the first conclusion I'd jump to. This article is just speculation to me and the methodology seems ... bad edit: sorry if the markdown is broken. Noob here. ;)
- ludjer 7y agoIF you are going to try look for open ports they certainly wont be using the standard ports. You will need to do a full scan "nmap -p". But doing that is considered malicious and you can be sued. So I would advise against scanning random hosts that you do not have permission to scan.
- Spy520 7y agoWon’t services like this take advantage of UPnP to open ports? I know FluidStack which is a similar service uses UPnP to open ports that it requires. FluidStack is a service you earn money through by willingly selling your internet bandwidth though, not like Oxylabs but same idea.
- EternalAugust 7y agoFirst, sorry for the late reply. I don't log in often. I didn't consider malware using UPnP. But it seems to me that the probability of malware using it to make a residential IP look like a business IP (e.g. opening up ports for VoIP) is pretty low. But always possible. I didn't know about FluidStack. Looks interesting. If you have numbers on how many people actually use such a service I would be really interested to know :)
- asimpletune 7y agoDoes anyone know if they’ve provided any response on this?
- hombre_fatal 7y ago> It’s often the case that VPN users will find that services like Disney+ are blocked on many servers, presumably because the content provider is able to discover the VPN’s IP addresses and restrict access to those IPs. Something that keeps bothering me about the title and content is that the VPN isn't blocking or unblocking Disney+. It's Disney+ that's doing the blocking. It's blocking the VPN's IP addresses. If I block you from entering the building but you find a secret entrance through the air vents, you didn't unblock me, you evaded my block. Their title and usage of blocking should be something more like: "How is NordVPN evading Disney+'s VPN-blocking?" Great article though. This kind of stuff really needs to be more well known. That it's possible to unknowingly be part of a botnet is a major flaw in the internet and ISP billing model. I think the only solution that has a shot is for unexpected bandwidth to lead to an unexpectedly high bill.
- mirimir 7y agoAs much as I love VPN services, this is indeed creepy. I mean, why stop at using whatever app installs as exits? Why not route a VPN service through an actual botnet?
- sas41 7y agoI have to say, the use of residential IPs as proxy for your traffic is essentially digital money laundering for data, or Data Laundering if you will. (IP laundering?) It's one thing to use a VPN, another to use some unaware person's computer for your mischief (think about someone doing illegal stuff using this method). Knowing how the law works in some places, and how ill-informed some law people are, I can totally see an innocent man getting locked up for illegal stuff, like hacking or other stuff that I dare not say.
- mirimir 7y agoHey, this is an ~old thread. But I'd like to contact the author, Derek Johnson. And, having no Facebook or Google account, I can't even create a Medium account to post a comment. So do any y'all perchance know his address? If so, please email me at the address in my profile.