Hacker News Reader

Comment by stoniejohnson | Hacker News Reader

only bummer is that due to their strong respect of user anonymity a lot of their IPs are blocked by major platforms like Reddit

View on HN

I use Mullvad and Reddit has never tried to block me, in fact I've run into no blocks at all. Then again my browsing habits are quite boring.

you are likely logged in! they only enforce the blocklist on lurkers

You're correct, and I just tested it... seems that about half of Mullvad IP's are in fact blocked if you're logged out. Good catch.

how are platforms like reddit able to get complete list of mullvad IPs and other vpns but not residential proxies?

people use mullvad IPs maliciously -> those IPs end up on blocklists

It’s an industry now e.g. https://ipinfo.io

damn this is crazy, how did they even compile all the residential proxies

im seeing it detect!!

Net flows. A residential proxy should have a residential amount of traffic coming from it. If one IP has 1000x the usual traffic one household could reasonably account for, then mark it as a residential proxy. It won't be 100% accurate, but it's sufficiently accurate for reddit to go on a blocking spree.

How does one even get access to that kind of information? Are ISPs just selling this stuff or what?

We have 700 servers around the world and we run measurements over all of the usable internet space, including assigned IPv6 addresses.

I highly recommend reading some of our blog posts and community posts.

You can also checkout our IP data tags page: https://ipinfo.io/tags

Our detection model at ipinfo is largely based on behavior models of IP addresses. We have 700 servers around the world from which we run internet measurement, allowing us to reliably determine which IP addresses are VPNs or proxies. These measurements are largely ping/traceroute data, which enable us to estimate a number of different things most importantly IP location data.

If you are interested in what kind of other information we can discover from our internet measurements, check out our tags page: https://ipinfo.io/tags

I am not sure how they do it, but one option is setting some arbitrary threshold for number of devices fingerprinted on a single ip in a given period of time. Something like taking the average number of devices and denying access to ips that they detect ~3 sigma different devices from.

Well I don't know how many IP addresses each of Mullvad's servers have, but they list a domain name, IPv4 and IPv6 address for all of them publicly[1].

[1]: https://mullvad.net/en/servers

Reply on news.ycombinator.com