Is it possible to find the real IP address of someone using a proxy to change his or her IP address?
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
Attackers often use proxy servers to hide their IP addresses from the administrators of systems they are trying to access. Other individuals may use proxy servers as a tool to protect their own privacy. No matter the intent, individuals hiding their identity behind a proxy server always leave some trail of digital breadcrumbs.
In the simplest situation, where an attacker uses a single proxy server to relay traffic to its final destination, the technical part of tracking the user down is easy. You simply need to analyze the proxy server logs, find the connection request to the target server and look at the source IP address. Unfortunately, while this is technically simple, gaining access to the proxy server logs is easier said than done. In the best case, you’ll bump up against a company that was unwittingly running the proxy server and is eager to eradicate it quickly from its network. In that situation, you’ll probably be redirected to their corporate lawyer, who likely won’t be eager to share information with you that could later be used as evidence that the company was negligent or even complicit in any attack launched through the proxy. In that situation, it’s probably going to take the involvement of law enforcement and a court order to gain access to the proxy server logs, if they even exist.
In the worst case, the proxy server may actually be run by someone who is intentionally providing a privacy-enhancing service that operates under the protection of the laws of the country where the server is located. You’re going to have a hard time getting anything in this scenario, because the proxy server is likely configured not to keep logs and, even if the logs do exist, you’ll have a hard time finding a law enforcement officer in that country who is willing to assist you.
If that’s not enough to intimidate you, many attackers use multiple proxy servers to hide their true location, so you’ll probably need to repeat this process multiple times in order to find the real IP address!
Dig Deeper on IPsec VPN Security
Related Q&A from Mike Chapple
Encrypting data going to the cloud is a security best practice, but does it add extra challenges for regulators that might need to access the data? ...continue reading
Merchants that sell at off-site venues need to take extra care to follow PCI compliance standards. Expert Mike Chapple discusses how organizations ...continue reading
The FTC's order for PCI DSS compliance assessments is odd since PCI isn't a government regulation. Expert Mike Chapple explains the motivation ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.