Без комментариев. Версия 2.5.8
Summary
| __ ) _ _ | __ ) _ _ __\ \ / / _ | \ | |
| _ | | | |/ _ \ _ | | | |/ _ \ \ / /| |) | | |
| |) | || | / |) | || | /\ V / | /| |\ |
|___/ _, |_|___/ _, |_| _/ || || _|
|/ |__/
Full TSPU/DPI/VPN detectability scanner v2.5.8
[1] Full scan — end-to-end scan of an IP/hostname
[2] TCP port scan — TCP port-scan only
[3] UDP probes — OpenVPN / WireGuard / IKE / QUIC / DNS
[4] TLS + SNI consistency — TLS audit on a single port (Reality discriminator)
[5] J3 active probing — TSPU/GFW-style probes on one port
[6] GeoIP lookup — country / ASN / VPN-flag aggregation
[7] Local analysis — this machine: VPN adapters, split-tunnel, processes
[8] SNITCH latency check — RTT + GeoIP consistency (methodika §10.1)
[9] Traceroute — ICMP hop count analysis (ttl sweep)
[0] Exit
1
target (IP or hostname): 4pda.to
[1/8] DNS resolve
4pda.to → 104.20.39.144 172.66.159.63 [v4, 348ms]
using primary IP 104.20.39.144 for all probes
[2/8] GeoIP (9 providers in parallel: 3 EU / 3 RU / 3 global)
ipapi.is IP 104.20.39.144 US (San Francisco) AS 13335 Cloudflare, Inc.
flags: HOSTING
iplocate.io IP 104.20.39.144 US (New York City) AS AS13335 Cloudflare, Inc.
flags: HOSTING
freeipapi.com err: http 0 io 12002
2ip.me (RU) err: http 0 io 12002
IP-API.com - Geolocation API (RU) IP 104.20.39.144 CA (Торонто) AS AS13335 Cloudflare, Inc. Cloudflare, Inc.
flags: HOSTING
sypexgeo.net (RU) IP 104.20.39.144 US-CA (San Francisco) AS
ip-api.com IP 104.20.39.144 CA (Toronto) AS AS13335 Cloudflare, Inc. Cloudflare, Inc.
flags: HOSTING
ipwho.is IP 104.20.39.144 US (San Francisco) AS 13335 Cloudflare, Inc.
ipinfo.io IP 104.20.39.144 US (San Francisco) AS AS13335 Cloudflare, Inc.
[3/8] TCP port scan mode=FULL 1-65535 (65535 ports, 500 threads, 800ms timeout)
(press ‘q’ to skip this phase)
scan done (65535/65535, open=10)
:80 106ms HTTP
:443 125ms HTTPS / XTLS / Reality
:2052 153ms -
:2053 141ms -
:2082 150ms -
:2083 172ms -
:2086 160ms -
:2087 185ms -
:2095 167ms -
:2096 184ms -
[4/8] UDP probes
UDP:53 DNS query no answer (no-reply / filtered)
UDP:500 IKEv2 SA_INIT no answer (no-reply / filtered)
UDP:4500 IKEv2 NAT-T no answer (no-reply / filtered)
UDP:1194 OpenVPN HARD_RESET no answer (no-reply / filtered)
UDP:443 QUIC v1 Initial no answer (no-reply / filtered)
UDP:51820 WireGuard handshake no answer (no-reply / filtered)
UDP:41641 Tailscale handshake no answer (no-reply / filtered)
UDP:1701 L2TP SCCRQ no answer (no-reply / filtered)
UDP:36712 Hysteria2 QUIC no answer (no-reply / filtered)
UDP:8443 TUIC v5 no answer (no-reply / filtered)
UDP:55555 AmneziaWG Sx=8 no answer (no-reply / filtered)
UDP:51820 AmneziaWG Sx=8 no answer (no-reply / filtered)
[5/8] Service fingerprints per open port
:80 HTTP HTTP/1.1 403 Forbidden | Server: cloudflare %[cloudflare]
:80 HTTP-PROXY HTTP/1.1 400 Bad Request [vpn-like]
:443 TLS TLSv1.3 / TLS_AES_256_GCM_SHA384 / ALPN=h2 / / 342ms
cert CN=4pda.to issuer=WE1 age=56d left=33d SAN=2 wildcard [free-CA]
SNI behaviour: cert varies per SNI (normal multi-tenant TLS, not Reality)
cert-sha256: 7eb1e05a131366d4… issuer: /C=US/O=Google Trust Services/CN=WE1
CT-log (crt.sh): cert IS in public CT logs (0 entries) — normal legit cert
HTTP-over-TLS: HTTP/1.1 403 Forbidden Server: cloudflare
[cdn] Cloudflare (CF-Ray=9f8484f0fe79a0f1-HKG)
:2052 unknown open but silent on connect (ambiguous: firewalled service / Shadowsocks / Trojan / Reality wrapper — inconclusive without protocol match)
:2053 unknown open but silent on connect (ambiguous: firewalled service / Shadowsocks / Trojan / Reality wrapper — inconclusive without protocol match)
:2082 unknown open but silent on connect (ambiguous: firewalled service / Shadowsocks / Trojan / Reality wrapper — inconclusive without protocol match)
:2083 TLS TLSv1.3 / TLS_AES_256_GCM_SHA384 / ALPN=h2 / / 325ms
cert CN=4pda.to issuer=WE1 age=56d left=33d SAN=2 wildcard [free-CA]
SNI behaviour: cert varies per SNI (normal multi-tenant TLS, not Reality)
cert-sha256: 7eb1e05a131366d4… issuer: /C=US/O=Google Trust Services/CN=WE1
CT-log (crt.sh): query failed — http 0
HTTP-over-TLS: HTTP/1.1 403 Forbidden Server: cloudflare
[cdn] Cloudflare (CF-Ray=9f8485465f930eb8-HKG)
:2086 unknown open but silent on connect (ambiguous: firewalled service / Shadowsocks / Trojan / Reality wrapper — inconclusive without protocol match)
:2087 TLS TLSv1.3 / TLS_AES_256_GCM_SHA384 / ALPN=h2 / / 311ms
cert CN=4pda.to issuer=WE1 age=56d left=33d SAN=2 wildcard [free-CA]
SNI behaviour: cert varies per SNI (normal multi-tenant TLS, not Reality)
cert-sha256: 7eb1e05a131366d4… issuer: /C=US/O=Google Trust Services/CN=WE1
CT-log (crt.sh): cert IS in public CT logs (0 entries) — normal legit cert
HTTP-over-TLS: HTTP/1.1 403 Forbidden Server: cloudflare
[cdn] Cloudflare (CF-Ray=9f848590594b03b7-HKG)
:2095 unknown open but silent on connect (ambiguous: firewalled service / Shadowsocks / Trojan / Reality wrapper — inconclusive without protocol match)
:2096 TLS TLSv1.3 / TLS_AES_256_GCM_SHA384 / ALPN=h2 / / 316ms
cert CN=4pda.to issuer=WE1 age=56d left=33d SAN=2 wildcard [free-CA]
SNI behaviour: cert varies per SNI (normal multi-tenant TLS, not Reality)
cert-sha256: 7eb1e05a131366d4… issuer: /C=US/O=Google Trust Services/CN=WE1
CT-log (crt.sh): cert IS in public CT logs (0 entries) — normal legit cert
HTTP-over-TLS: HTTP/1.1 403 Forbidden Server: cloudflare
[cdn] Cloudflare (CF-Ray=9f8485d1ccc920fb-HKG)
[6/8] J3 / TSPU active probing
→ port :80
SILENT empty/close (dropped)
RESP HTTP GET / 412B HTTP/1.1 403 Forbidden [48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72]
RESP HTTP CONNECT 316B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP SSH banner 316B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP random 512B 316B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
SILENT TLS CH invalid-SNI (dropped)
RESP HTTP abs-URI (proxy-style) 843B HTTP/1.1 200 OK [48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d]
RESP 0xFF x128 316B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
→ responds to arbitrary bytes (plaintext HTTP-style origin) (silent=2 / resp=6)
→ port :443
SILENT empty/close (dropped)
RESP HTTP GET / 414B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP HTTP CONNECT 316B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP SSH banner 316B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP random 512B 316B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP TLS CH invalid-SNI 7B …2 [15 03 01 00 02 02 32]
RESP HTTP abs-URI (proxy-style) 414B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP 0xFF x128 7B …F [15 03 01 00 02 02 46]
→ responds to arbitrary bytes (plaintext HTTP-style origin) (silent=1 / resp=7)
uniform reply: the SAME first-line (414B ‘HTTP/1.1 400 Bad Request’) for 2 raw-TCP probes, but the HTTP-over-TLS probe is clean — that’s normal nginx/CDN behaviour on a TLS port (not a fallback)
→ port :2083
SILENT empty/close (dropped)
RESP HTTP GET / 414B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP HTTP CONNECT 316B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP SSH banner 316B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP random 512B 316B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP TLS CH invalid-SNI 7B …2 [15 03 01 00 02 02 32]
RESP HTTP abs-URI (proxy-style) 414B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP 0xFF x128 7B …F [15 03 01 00 02 02 46]
→ responds to arbitrary bytes (plaintext HTTP-style origin) (silent=1 / resp=7)
uniform reply: the SAME first-line (414B ‘HTTP/1.1 400 Bad Request’) for 2 raw-TCP probes, but the HTTP-over-TLS probe is clean — that’s normal nginx/CDN behaviour on a TLS port (not a fallback)
→ port :2087
SILENT empty/close (dropped)
RESP HTTP GET / 414B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP HTTP CONNECT 316B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP SSH banner 316B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP random 512B 316B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP TLS CH invalid-SNI 7B …2 [15 03 01 00 02 02 32]
RESP HTTP abs-URI (proxy-style) 414B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP 0xFF x128 7B …F [15 03 01 00 02 02 46]
→ responds to arbitrary bytes (plaintext HTTP-style origin) (silent=1 / resp=7)
uniform reply: the SAME first-line (414B ‘HTTP/1.1 400 Bad Request’) for 2 raw-TCP probes, but the HTTP-over-TLS probe is clean — that’s normal nginx/CDN behaviour on a TLS port (not a fallback)
→ port :2096
SILENT empty/close (dropped)
RESP HTTP GET / 414B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP HTTP CONNECT 316B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP SSH banner 316B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP random 512B 7B …F [15 03 01 00 02 02 46]
RESP TLS CH invalid-SNI 7B …2 [15 03 01 00 02 02 32]
RESP HTTP abs-URI (proxy-style) 414B HTTP/1.1 400 Bad Request [48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64]
RESP 0xFF x128 7B …F [15 03 01 00 02 02 46]
→ responds to arbitrary bytes (plaintext HTTP-style origin) (silent=1 / resp=7)
uniform reply: the SAME first-line (414B ‘HTTP/1.1 400 Bad Request’) for 2 raw-TCP probes, but the HTTP-over-TLS probe is clean — that’s normal nginx/CDN behaviour on a TLS port (not a fallback)
[7/8] SNITCH latency + traceroute + SSTP
SNITCH RTT: median=84.2ms min=82.3ms max=101.2ms stddev=7.0ms (6 samples)
Anchors: Cloudflare=116ms Google=130ms Yandex=121ms
Expected: country=US physical_min=100ms (from US observer)
=> target RTT doesn’t match closest anchor ratio — location doesn’t add up
Traceroute: 8 hops, reached=yes, max_rtt_jump=78ms, long_hops(>150ms)=0
1 192.168.1.1 0ms
2 10.251.14.121 48ms
3 10.251.14.122 4ms
4 87.226.133.55 82ms
5 63.217.237.29 80ms
6 63.218.174.130 79ms
7 *
8 103.22.203.23 80ms
9 104.20.39.144 80ms
SSTP/443: SSTP? TLS handshake failed (not HTTPS)
Our ClientHello JA3: 0cce74b0d9b7f8528fb2181588d23793 (OpenSSL 3.x default — real browsers use uTLS-Chrome)
[8/8] Verdict
Stack identified: 3x-ui/x-ui/Marzban panel install (multiple preset TLS ports open) — VLESS/Trojan/Shadowsocks multiplex likely
Per-port classification:
:443 generic HTTPS / CDN origin (junk probes get HTTP 4xx as expected) — TLSv1.3 / ALPN=h2 / CN=4pda.to / issuer=WE1 / age=56d / validity=90d / SAN=2
:2083 generic HTTPS / CDN origin (junk probes get HTTP 4xx as expected) — TLSv1.3 / ALPN=h2 / CN=4pda.to / issuer=WE1 / age=56d / validity=90d / SAN=2
:2087 generic HTTPS / CDN origin (junk probes get HTTP 4xx as expected) — TLSv1.3 / ALPN=h2 / CN=4pda.to / issuer=WE1 / age=56d / validity=90d / SAN=2
:2096 generic HTTPS / CDN origin (junk probes get HTTP 4xx as expected) — TLSv1.3 / ALPN=h2 / CN=4pda.to / issuer=WE1 / age=56d / validity=90d / SAN=2
:80 OPEN HTTP PROXY (accepts CONNECT) — HTTP/1.1 400 Bad Request
DPI exposure matrix:
Port-based (default VPN ports) LOW no default VPN ports among open set
Protocol handshake signature LOW TLS handshake looks normal
Cert-steering (Reality discriminator) NONE cert varies per SNI (multi-tenant TLS, not Reality)
ASN classifier (VPS/hosting) LOW 4 sources classify the ASN as hosting/datacenter — normal for any public server
Threat-intel tags (VPN/Proxy/Tor) NONE no VPN/Proxy/Tor tag from any source
Cert freshness (new-LE watch) LOW no suspiciously fresh certs
Active junk probing (J3) LOW 34 responses — looks like a permissive web-origin
Open-port profile (sparsity) HIGH 10 ports open, dominated by the 3x-ui/x-ui/Marzban preset TLS cluster 4 hits (2053/2083/2087/2096/8443/…) — installer fingerprint
TLS hygiene (1.3 + h2 + trusted-CA) LOW TLS posture is clean (1.3 + h2 + trusted-CA)
Cert impersonation (Reality-static tell) NONE no cert claims a major-brand domain the ASN doesn’t own
Active HTTP-over-TLS probe LOW 4 port(s) returned a well-formed HTTP reply with a Server: header — looks like a real web origin
Panel-port cluster (3x-ui/x-ui/Marzban) HIGH 4 of the preset panel TLS ports are open (2053/2083/2087/2096/8443/8880/6443/7443/9443)
J3 canned/anomaly aggregate LOW no canned / bad-version / raw-non-HTTP replies
Strong signals (2) [! = real evidence of VPN/proxy]
[!] 4 of the classical 3x-ui/x-ui/Marzban panel TLS ports are open ({2053,2083,2087,2096}) — installer fingerprint; regular webhosts rarely open this exact set
[!] open HTTP proxy (accepts CONNECT) on :80
Soft signals (0) [- = suggestive pattern, not proof]
(none)
Informational (3) [i = observation only, no penalty — normal sites can have these]
[i] asn-hosting 4 of 9 sources classify the ASN as hosting/datacenter (normal for any public server — not a red flag on its own)
[i] snitch-anchor SNITCH: target RTT doesn’t match the closest anchor ratio — geolocation may be off
[i] trace-ok traceroute: 8 hops, max RTT step 78ms — path looks clean
Final score: 66/100 verdict: SUSPICIOUS
Hardening suggestions:
[xui-panel]
The open-port profile matches the 3x-ui / x-ui / Marzban panel installer set
(2053/2083/2087/2096/8443/8880/6443/7443/9443). That exact cluster is the
single strongest fingerprint a TSPU-class DPI engine looks for. Fix: close
the unused panel ports (keep ONE listener on :443 on the real Reality inbound),
firewall the panel UI to admin source IPs only, and avoid the defaults.
[asn-hosting]
Being on a hosting ASN is the norm for every public server — this alone is
NOT a VPN signal. TSPU does use ASN as a gate for deeper checks, but
what it then verifies is the TLS/HTTP behaviour, not the ASN itself.
If you want to escape the ‘hosting ASN’ category entirely, the only
clean move is a residential-ASN proxy in front (rare) or a CDN.
ТСПУ / TSPU classification (emulated Russian DPI verdict):
Verdict: THROTTLE / QoS — 1 B-tier anomaly — TSPU would tag this host for further monitoring / rate-limiting but not instant block
TSPU-tier hits: A=0 (protocol block) / B=1 (soft anomaly)
Triggered rules:
[B] 3x-ui/x-ui/Marzban panel Panel-installer preset TLS-port cluster open
What the operator sees:
The destination is flagged but not blocked. Flows are logged, RTT +
handshake patterns are sampled over time. If the anomaly persists or
converges with other hosts in the same /24, the block threshold trips.
Threat-model note:
TSPU/GFW classify a destination by what the IP actually does on the wire —
TLS handshake bytes, cert-steering, active HTTP-over-TLS reply shape,
reactions to junk, default-port replies. IP ‘reputation’ (hosting ASN /
GeoIP VPN tag) is only a coarse pre-filter, so this tool treats it as
informational and focuses the score on the actual protocol signatures at
the endpoint. v2.4 strong signals are: cert impersonation (brand CN on
non-owning ASN), short-validity certs (<14d), canned-fallback pages,
HTTP-version anomalies, 3x-ui/x-ui/Marzban panel-port clusters, CT-log
absence on fresh certs, proxy-chain header leakage (Via/Forwarded/XFF),
SNITCH geo-latency inconsistency (§10.1), modern tunnels (AmneziaWG /
Hysteria2 / TUIC / L2TP / SSTP) — these are expensive-to-fake tells that
map directly to Xray / Reality / Trojan / modern obfuscated VPN stacks.
If every strong signal is ‘none’ and soft signals are quiet, the host is
essentially invisible to passive DPI regardless of what the ASN looks like.
Reference methodology: Russian OCR методика выявления VPN/Proxy (§5-10).
[Enter] to continue…
