Can somebody tell me how I can tell if an order is placed through a proxy?

I received an order today that looks suspicous which was placed through AT&T's network leading back to Middleton, NJ. I did a traceroute on the IP Address submitted with the order and it matches the IP address their domain name points to in the traceroute. They say they are from Indiana but I am wondering if they are connecting to the server from some other location to cover up their location.

Jeff

No easy way to tell. You need to do a portscan and try to determine if it is an open proxy server. I believe that's the only solution.

Is that difficult to do? If not, can you please tell me how?

Jeff

It is easy to do, but you shouldn't be scanning other people's networks. IMHO.

Scanning is A LOT different from attempting a connection to 4 frequently used ports to see if they're active. Unfortunately, the results wouldn't be 100% accurate.

You could attempt a connection to:
3128 (squid proxy)
8080 (common proxy port)
1080 (common socks proxy port)
80 (another common proxy port)

If any of these are open, it MIGHT be a proxy (note that it might also be a web site -- because of port 80 -- but how many users do you know of that connect from machines used as web sites?)

Dan

Originally posted by CagedTornado
Scanning is A LOT different from attempting a connection to 4 frequently used ports to see if they're active...

That's scanning.