Advanced techniques for detecting a proxy/getting original IP

Question

In what manner can a website detect my original IP address, even though I'm using a proxy server? I've noticed this with a few sites. There are four proxy methods I've used:

• Firefox with a proxy setting.
• Python with mechanize.set_proxies.
• Firefox in a virtual machine with a virtual machine router such that all of the VM's internet goes through a proxy.
• TorBrowser (which uses Firefox as the actual browser).

The following things are behaviors I've noticed that are expected:

• With all of these, if I go to http://www.whatismyip.com/, it gives the correct IP address (the IP address of the proxy, not the host computer).
• whatismyip.com says "No Proxy Detected" for all of these.

Indeed, it seems like the websites I visit do think my IP is that of the proxy. However, there have been a few weird cases which makes me think that some sites can somehow detect my original IP address. I'm curious how they go about doing that.

• In one situation, visiting a non-US site via Firefox with a non-US proxy, the site literally was able to print my originating IP address (from the US) and deny me access. Shouldn't this be impossible? Visiting the site via the virtual machine with that same non-US proxy, or the TorBrowser with a non-US exit node, though, the site was unable to do so.
• In a similar situation, I was visiting another non-US site from a non-US proxy. If I logged into the site from Firefox within the virtual machine, or from the TorBrowser with a non-US exit node, the site would work properly. However, if I attempted to log in via Firefox with a proxy (the same proxy the virtual machine uses), or with mechanize, it would fail to log in with an unrelated error message.
• In a third situation, using the mechanize.set_proxies option, I overloaded a site with too many requests so it decided to block access (it would purposefully time out whenever I logged in). I thought it might have blocked the proxy's IP address. However, when I ran the code from a different host machine, but with the same proxy, it worked again, for a short while, until they blocked it again. (No worries, I won't be harassing the site any further - I kept running the program as I thought it might have been a glitch on my end, not a block from their end.) Visiting that site with the Firefox+proxy solution from one of the blocked hosts also resulted in the purposeful timeout.

It seems to me that all of these sites, in the Firefox + proxy and mechanize cases, were able to find out something about the host machine's IP address, whereas in the TorBrowser and virtual machine cases, they weren't. My question is essentially: How are the sites able to gather this information? Another way to ask is: what is different about the TorBrowser and virtual machine cases that prevents the sites from gathering this information?

Answer 1

the site literally was able to print my originating IP address (from the US) and deny me access. Shouldn't this be impossible?

It sounds like you're expecting anonymity.

Proxies can be elective about whether or not they send the X-Forwarded-For header (which contains the originating IP).

A proxy that doesn't send this header, or record the originating IP in logs, is said to be an "anonymizing" proxy. In the case you mention, the proxy you were using likely forwarded this header to the endpoint you were accessing, so your connection was not anonymized.

There are multiple ways to detect whether or not your traffic is of proxy origin. Two easy ones are:

• Presence of the X-Forwarded-For header (or custom data in forwarded headers)
• Cross-checking known IPs of proxies or exit relays (TOR)
  • databases maintained by third parties (e.g. Quova)

There are other ways, possibly requiring additional intelligence on the server, perhaps to correlate requests across connections from different IPs, i.e. looking at user-agent criteria and timing of requests, cookies, LSOs in flash, (one of the reasons you'd want cookies and Flash player disabled to really anonymize yourself).

In short, just "using a proxy" alone does not make you anonymous or untraceable.

Answer 2

Except using IP in order to find a visitor's location, it is also possible to do so using Firefox's API, According to Mozilla:

If you consent, Firefox gathers information about nearby wireless access points and your computer’s IP address. Then Firefox sends this information to the default geolocation service provider, Google Location Services, to get an estimate of your location. That location estimate is then shared with the requesting website.

So using proxy server alone, except the fact it is, by itself, not an anonymising tool, is not enough. (read parallaxed answer for more theral answer about this).

TOR bundle offers you Firefox browser that denies all requests for information, as well as not keeping track of your whereabouts, while the VM don't have access to your gateway real information and wireless information.

Note that different browsers gather the geolocation differently, so while Firefox uses the wireless AP around you, other browsers sometimes uses the time zone of your computer, GPS that connected to your computer, and more.

Try this link to mozilla's geo location manual for disabling this feature in your browser, and this for seeing what information Firefox sends about your geo location.

Answer 3

Try to use third party tools, those tools will not track your ip address. I am using the tools like hotspot shield which will change your IP address. For verification you can login to the url what you had mentioned and see the IP, it will show as U.S IP.

Answer 4

You should set up your flash player and java to use the proxy or try disabling the flashplayer plugin and java plugin in the firefox browser. The two plugins are notorious for sending user original ip address even through a proxy server. Also the proxy you used might have been blacklisted on the web-server or a lot of people were using the same proxy to access the same site violating the QoS policy of the server.