- Three-network route test: Modified from [NTrace-core](https://github.com/nxtrace/NTrace-core) to [nt3](https://github.com/oneclickvirt/nt3)
- Speed test: Based on data from [speedtest.net](https://github.com/spiritLHLS/speedtest.net-CN-ID) and [speedtest.cn](https://github.com/spiritLHLS/speedtest.cn-CN-ID), developed to [oneclickvirt/speedtest](https://github.com/oneclickvirt/speedtest)
- Three-network Ping test: Modified from [ecsspeed](https://github.com/spiritLHLS/ecsspeed) to [pingtest](https://github.com/oneclickvirt/pingtest)
- Support root or admin environment testing, support non-root or non-admin environment testing, support offline environment for testing, not support no DNS environment for testing
- Support root or admin environment testing, support non-root or non-admin environment testing, support offline environment for testing, **not yet** support no DNS online environment for testing
**For first-time users of this project, it is recommended to check the instructions: [Jump to](https://github.com/oneclickvirt/ecs/blob/master/README_NEW_USER.md)**
@@ -241,6 +241,8 @@ Usage: goecs [options]
1. Download the compressed file with the .exe file: [Releases](https://github.com/oneclickvirt/ecs/releases)
2. After unzipping, right-click and run as administrator.
PS: If it's a VM environment, it's OK not to run it in administrator mode, because VMs have no native testing tools and will automatically enable alternative methods for testing.
这类历史记录会被举报并录入 Abuse 数据库。如果你接手的 IP 刚被他人滥用过，可能仍会有延迟的 Abuse 警告邮件发送至服务商。服务商可能会误判为你本人从事恶意行为，进而清退机器，且大多数情况下无法退款。对跨国流媒体服务而言，Abuse 得分还可能影响平台对该 IP 的信誉评分。本地流媒体受影响较小，但风险依然存在。
| **stream** | High — Stable results, more realistic | Fast | Cross-platform (Linux/Windows/Unix) | Built-in dependencies, no additional installation required |
| **sysbench** | High — Can test CPU, memory, IO, threads, etc., reliable results | Medium | Cross-platform (Linux, partial Windows support) | Requires additional environment installation |
| **winsat** | Medium-High — Windows built-in tool, results environment-dependent | Medium | Windows only | Built-in on physical machines, unavailable on virtual machines |
| **mbw** | Medium — Results may be affected by cache/scheduling | Very Fast | Cross-platform (almost all Unix-like systems) | Built-in dependencies, no additional installation required |
| **dd** | Low — Results affected by cache | Fast | Cross-platform (almost all Unix-like systems) | Requires additional environment installation |
| stream | High — Stable results, more realistic | Fast | Cross-platform (Linux/Windows/Unix) | Built-in dependencies, no additional installation required |
| sysbench | High — Reliable results | Medium | Cross-platform (Linux, partial Windows support) | Requires additional environment installation |
| winsat | Medium-High — Windows built-in tool | Medium | Windows only | Built-in on physical machines, unavailable on virtual machines |
| mbw | Medium — Results may be affected by cache/scheduling | Very Fast | Cross-platform (almost all Unix-like systems) | Built-in dependencies, no additional installation required |
| dd | Low — Results affected by cache | Fast | Cross-platform (almost all Unix-like systems) | Built-in dependencies, no additional installation required |
### Disk Testing
@@ -518,18 +585,65 @@ So during testing, if the host currently uses official mainstream DNS, no judgme
Detects IP-related information from 14 databases. Generally speaking, looking at usage type, company type, and security information's other discriminators is sufficient. Security scores are really just for fun. When multiple platforms show corresponding detection items all having corresponding values, it proves the current IP is indeed as such - don't trust information from just one database source.
Detect IP-related information from 14 databases. Multiple platforms comparing corresponding detection items all show corresponding values, proving that the current IP is indeed as such. Do not only trust information from a single database source.
* **Usage Type & Company Type**: Shows IP attribution and usage scenarios, such as whether it belongs to home users, enterprise office, hosting services, or cloud/data centers.
* **Cloud Provider / Data Center / Mobile Device**: Determines if IP comes from cloud services, data centers, or mobile networks, helping identify shared or high-risk IPs.
* **Proxy / VPN / Tor / Tor Exit**: Detects if IP is used to hide real identity or location, possibly involving anonymous access or abuse behavior.
* **Web Crawler / Bot**: Identifies automated access or collection programs, with reference value for security risk assessment.
* **Anonymous / Abuser / Threat / Relay / Bogon**: Shows IP historical behavior characteristics and whether it belongs to reserved/unallocated IPs, assisting in judging IP credibility.
* **Security Score, Reputation, Trust Score, Threat Score, Fraud Score, Abuse Score**: Various databases' quantified security evaluations of IPs, for reference only.
* **Community Voting & Blacklist Records**: Shows user feedback and public blacklist information, can quickly identify potential risks.
* **Google Search Feasibility**: Tests IP's feasibility for accessing Google search services, indirectly reflecting network restrictions or blocking situations.
The following are the meanings corresponding to each field
Multi-platform comparison is more reliable. Different databases have different algorithms and update frequencies; single sources may misjudge. Similar results from multiple databases indicate higher reliability.
| Field Category | Field Name | Field Description | Possible Values | Scoring Rules |
| Security Score | Reputation | Reputation score of IP address in the security community | Numerical value from 0-100 | Higher is better |
| | Trust Score | Trustworthiness score of IP address | Numerical value from 0-100 | Higher is better |
| | VPN Score | Likelihood score of IP being identified as VPN | Numerical value from 0-100 | Lower is better |
| | Proxy Score | Likelihood score of IP being identified as proxy | Numerical value from 0-100 | Lower is better |
| | Community Votes-Harmless | Score of community members voting the IP as harmless | Non-negative integer | Higher is better |
| | Community Votes-Malicious | Score of community members voting the IP as malicious | Non-negative integer | Lower is better |
| | Threat Score | Overall threat level score of IP address | Numerical value from 0-100 | Lower is better |
| | Fraud Score | Likelihood score of IP address being involved in fraudulent activities | Numerical value from 0-100 | Lower is better |
| | Abuse Score | Score of IP address being reported for abusive behavior | Numerical value from 0-100 | Lower is better |
| | ASN Abuse Score | Abuse score of the ASN (Autonomous System) to which this IP belongs | Decimal from 0-1, may include risk level notation (Low/Medium/High) | Lower is better |
| | Company Abuse Score | Abuse score of the company to which this IP belongs | Decimal from 0-1, may include risk level notation (Low/Medium/High) | Lower is better |
| | Threat Level | Threat level classification of IP address | Text descriptions such as low/medium/high/critical | low is best |
| Blacklist Records | Harmless Count | Number of times marked as harmless in various blacklist databases | Non-negative integer | Value itself has no good or bad |
| | Malicious Count | Number of times marked as malicious in various blacklist databases | Non-negative integer | Lower is better |
| | Suspicious Count | Number of times marked as suspicious in various blacklist databases | Non-negative integer | Lower is better |
| | Undetected Count | Number of times with no records in various blacklist databases | Non-negative integer | Value itself has no good or bad |
| | DNS Blacklist-Total Checks | Total number of DNS blacklist databases checked | Positive integer | Value itself has no good or bad |
| | DNS Blacklist-Clean | Number showing as clean (not listed) in DNS blacklists | Non-negative integer | Higher is better |
| | DNS Blacklist-Listed | Number already listed in DNS blacklists | Non-negative integer | Lower is better |
| | DNS Blacklist-Other | Number returning other statuses in DNS blacklist checks | Non-negative integer | Value itself has no good or bad |
Generally speaking, looking at the usage type, company type, and security information judgment below is sufficient. The security scores above are only credible when confirmed consistently by multiple databases; not looking at them is not a problem.
| Field Category | Field Name | Field Description | Possible Values | Scoring Rules |
| Usage Type | Usage Type | Primary usage classification of IP address | hosting/residential/business/cellular/education/government/military/DataCenter/WebHosting/Transit/CDN, etc. | No good or bad, classification only |
| Company Type | Company Type | Business type of the company to which the IP belongs | business/hosting/FixedLineISP/education/government, etc. | No good or bad, classification only |
| Cloud Provider | Is Cloud Provider | Whether this IP belongs to a cloud service provider | Yes/No | No good or bad, identification only |
| Data Center | Is Data Center | Whether this IP is located in a data center | Yes/No | If concerned about unblocking, No is best |
| Mobile | Is Mobile | Whether this IP comes from a mobile device network | Yes/No | If concerned about unblocking, Yes is best |
| Proxy | Is Proxy | Whether this IP is a proxy server | Yes/No | No is better |
| VPN | Is VPN | Whether this IP is a VPN service node | Yes/No | No is better |
| Tor Exit | Is TorExit (Tor Exit Node) | Whether this IP is an exit node of the Tor network | Yes/No | No is better |
| Crawler | Is Crawler | Whether this IP is identified as a web crawler | Yes/No | No is better |
| Anonymous | Is Anonymous | Whether this IP provides anonymity services (such as VPN/Proxy/Tor) | Yes/No | No is better |
| Attacker | Is Attacker | Whether this IP is identified as an attack source (such as DDOS) | Yes/No | No is better |
| Abuser | Is Abuser | Whether this IP has records of active abusive behavior | Yes/No | No is better |
| Threat | Is Threat | Whether this IP is marked as a threat source | Yes/No | No is better |
| Relay | Is Relay | Whether this IP is a relay node | Yes/No | No is better |
| Bogon | Is Bogon (Bogon IP) | Whether this IP is a forged/unallocated IP address | Yes/No | No is better |
| Bot | Is Bot | Whether this IP is identified as bot traffic | Yes/No | No is better |
| Search Engine | Google Search Viability | Whether this IP can normally use Google search services | YES/NO | YES is normal |
Multi-platform comparison is more reliable. Different databases have different algorithms and update frequencies; a single source may have misjudgments. When multiple databases show similar results, it indicates that the result is more reliable.
Abuser or Abuse score will directly affect the normal use of the machine
If Abuse records exist and the score is high, it indicates that the IP may have had the following behaviors in the past:
- Used for DDoS attacks
- Initiated large-scale flood attacks
- Conducted port scanning or network-wide scanning
Such historical records will be reported and recorded in the Abuse database. If the IP you take over has just been abused by others, there may still be delayed Abuse warning emails sent to the service provider. The service provider may misjudge that you yourself are engaging in malicious behavior, and then terminate the machine, and in most cases cannot refund. For cross-border streaming services, Abuse scores may also affect the platform's reputation scoring of that IP. Local streaming is less affected, but risks still exist.
_yellow "Unable to get version info, using default version 0.1.88"
ECS_VERSION="0.1.88"
_yellow "Unable to get version info, using default version 0.1.89"
ECS_VERSION="0.1.89"
fi
version_output=""
for cmd_path in "goecs" "./goecs" "/usr/bin/goecs" "/usr/local/bin/goecs"; do
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
