How on earth does this work?

#security

I was browsing the internet the other day and came across a site known as spur.us. The site claims to "Stops fraud and abuse on the internet" by collecting and indexing IP usage, VPN IPs, and proxy IPs.

Its a very interesting site, you can get info on any IP by visiting spur.us/context/youriphere. My question is, how does it work? How does a site collect data on every IP address out there? How do they know that X amount of people are on my IP address? How do they know that I have connected to the Tor network or used ProtonVPN?

Top comments (2)

Molly Crendraven • Oct 31 '21

My question is, how does it work? How does a site collect data on every IP address out there? How do they know that X amount of people are on my IP address? How do they know that I have connected to the Tor network or used ProtonVPN?

That's several questions :D

How does a site collect data on every IP address out there?

Automated scripts. You might also find projects like this one interesting: ant.isi.edu/address/

How do they know that X amount of people are on my IP address?

That depends a lot on your IP. If it's shared hosting site, they use DNS to IP mapping to count, like robtex.com/ip-lookup/74.125.68.100...

How do they know that I have connected to the Tor network

The same way sites do to decide to block you, by port scanning. Scan yourself :) grc.com/shieldsup

used ProtonVPN

Assuming that you were currently connected, by checking who owns that IP. For example, this IP is owned by Amazon's AWS service whois.urih.com/record/205.251.193....