Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In what manner can a website detect my original IP address, even though I'm using a proxy server? I've noticed this with a few sites. There are four proxy methods I've used:

  • Firefox with a proxy setting.
  • Python with mechanize.set_proxies.
  • Firefox in a virtual machine with a virtual machine router such that all of the VM's internet goes through a proxy.
  • TorBrowser (which uses Firefox as the actual browser).

The following things are behaviors I've noticed that are expected:

  • With all of these, if I go to http://www.whatismyip.com/, it gives the correct IP address (the IP address of the proxy, not the host computer).
  • whatismyip.com says "No Proxy Detected" for all of these.

Indeed, it seems like the websites I visit do think my IP is that of the proxy. However, there have been a few weird cases which makes me think that some sites can somehow detect my original IP address. I'm curious how they go about doing that.

  • In one situation, visiting a non-US site via Firefox with a non-US proxy, the site literally was able to print my originating IP address (from the US) and deny me access. Shouldn't this be impossible? Visiting the site via the virtual machine with that same non-US proxy, or the TorBrowser with a non-US exit node, though, the site was unable to do so.
  • In a similar situation, I was visiting another non-US site from a non-US proxy. If I logged into the site from Firefox within the virtual machine, or from the TorBrowser with a non-US exit node, the site would work properly. However, if I attempted to log in via Firefox with a proxy (the same proxy the virtual machine uses), or with mechanize, it would fail to log in with an unrelated error message.
  • In a third situation, using the mechanize.set_proxies option, I overloaded a site with too many requests so it decided to block access (it would purposefully time out whenever I logged in). I thought it might have blocked the proxy's IP address. However, when I ran the code from a different host machine, but with the same proxy, it worked again, for a short while, until they blocked it again. (No worries, I won't be harassing the site any further - I kept running the program as I thought it might have been a glitch on my end, not a block from their end.) Visiting that site with the Firefox+proxy solution from one of the blocked hosts also resulted in the purposeful timeout.

It seems to me that all of these sites, in the Firefox + proxy and mechanize cases, were able to find out something about the host machine's IP address, whereas in the TorBrowser and virtual machine cases, they weren't. My question is essentially: How are the sites able to gather this information? Another way to ask is: what is different about the TorBrowser and virtual machine cases that prevents the sites from gathering this information?

share|improve this question
    
TorBrowser purposely excludes a Flash plug-in, because Flash can (among other problems) be used to directly obtain the client IP address. ActiveX or JavaScript could also be culprits. –  pseudon Sep 11 '12 at 21:58
    
thanks! that makes sense, but it doesn't explain why mechanize didn't work (it has neither flash nor activex nor javascript) –  Claudiu Sep 11 '12 at 22:40
    
You could set up something on a server to see if mechanize is passing along HTTP headers that betray the original IP, something that whatismyip.com isn't checking. Try this too: whatismyipaddress.com/proxy-check I assume you cleared cookies between proxied and non-proxied attempts? A site may detect the change of IP address and infer the possibility of a proxy. –  pseudon Sep 13 '12 at 15:18
    
i tried the server check, printing out all the http headers from my server that i visited via the proxy, and it didn't look like the proxy was providing anything. the proxy-check also turned up false. cookies were cleared yea, i was using it in incognito mode –  Claudiu Sep 13 '12 at 15:28
1  
You can check your headers with the headers tool on this page: httpbin.org –  pseudon Sep 13 '12 at 15:29

4 Answers 4

You should set up your flash player and java to use the proxy or try disabling the flashplayer plugin and java plugin in the firefox browser. The two plugins are notorious for sending user original ip address even through a proxy server. Also the proxy you used might have been blacklisted on the web-server or a lot of people were using the same proxy to access the same site violating the QoS policy of the server.

share|improve this answer

Except using IP in order to find a visitor's location, it is also possible to do so using Firefox's API, According to Mozilla:

If you consent, Firefox gathers information about nearby wireless access points and your computer’s IP address. Then Firefox sends this information to the default geolocation service provider, Google Location Services, to get an estimate of your location. That location estimate is then shared with the requesting website.

So using proxy server alone, except the fact it is, by itself, not an anonymising tool, is not enough. (read parallaxed answer for more theral answer about this).

TOR bundle offers you Firefox browser that denies all requests for information, as well as not keeping track of your whereabouts, while the VM don't have access to your gateway real information and wireless information.

Note that different browsers gather the geolocation differently, so while Firefox uses the wireless AP around you, other browsers sometimes uses the time zone of your computer, GPS that connected to your computer, and more.

Try this link to mozilla's geo location manual for disabling this feature in your browser, and this for seeing what information Firefox sends about your geo location.

share|improve this answer
    
Forgive me for the naivety: I am not trying to challenge your answer, but in order to send your geo-location, would Firefox not require explicit authorization from the user? –  Lex Apr 15 '13 at 13:17
    
Yes: Check the quoted text from Mozilla: "If you consent...". –  Boaz Tirosh Apr 17 '13 at 11:59

Try to use third party tools, those tools will not track your ip address. I am using the tools like hotspot shield which will change your IP address. For verification you can login to the url what you had mentioned and see the IP, it will show as U.S IP.

share|improve this answer

the site literally was able to print my originating IP address (from the US) and deny me access. Shouldn't this be impossible?

It sounds like you're expecting anonymity.

Proxies can be elective about whether or not they send the X-Forwarded-For header (which contains the originating IP).

A proxy that doesn't send this header, or record the originating IP in logs, is said to be an "anonymizing" proxy. In the case you mention, the proxy you were using likely forwarded this header to the endpoint you were accessing, so your connection was not anonymized.

There are multiple ways to detect whether or not your traffic is of proxy origin. Two easy ones are:

  • Presence of the X-Forwarded-For header (or custom data in forwarded headers)
  • Cross-checking known IPs of proxies or exit relays (TOR)
    • databases maintained by third parties (e.g. Quova)

There are other ways, possibly requiring additional intelligence on the server, perhaps to correlate requests across connections from different IPs, i.e. looking at user-agent criteria and timing of requests, cookies, LSOs in flash, (one of the reasons you'd want cookies and Flash player disabled to really anonymize yourself).

In short, just "using a proxy" alone does not make you anonymous or untraceable.

share|improve this answer

protected by Community Feb 5 at 15:21

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.