5 ms·
My personal opinion is they're not hard to detect at all. Latency is a huge giveaway, If the client can't respond in a time you'd expect a client to be able to
by torginus 2mo ago
My personal opinion is they're not hard to detect at all. Latency is a huge giveaway, If the client can't respond in a time you'd expect a client to be able to based on its geographic location, that's a pretty big tell they're using proxies. In fact, if you did latency sensitive stuff, you'd likely find out whether you wanted to or not.
- AnthonyMouse 2mo agoThat's assuming they're tunneling the entire connection and not terminating it locally and then forwarding the data after it's downloaded. And also assuming that the only reason for higher latency is physical distance rather than crappy WiFi or corporate nanny filters or the client device swapping because the user can't afford more RAM.
- simoneree 2mo agoThis is not always the case, although plausible, as residential proxies exit on a real residential IP geographically near the victim/target, so RTT looks normal most times and latency won't reveal them. The actual tells are elsewhere: ASN/IP reputation, TLS (JA3/JA4) fingerprint vs. claimed client, and session-behavior inconsistencies.
- Chu4eeno 2mo agoBut the overall latency will be longer than expected because you add the latency from the proxy connection as well. If you're able to ping back to the connecting IP in combination with some clientside js to help measure total latency I think you should be able to reliably detect proxy users in general?
- arbol 2mo agoIt's not enough to use latency alone as the other commentor said. You need to look for repeat behaviour at scale. It's ML model time once these basic signals fail you.