Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I work for a small company who has troubles with third parties selling our products on Amazon. Sometimes those third parties have websites and when I use an IP address finder online it gives me coordinates to what I think is a proxy server because there has been a few times where I enter different IP addresses but I get the same coordinates. Is there a way that I can go through the proxy server and find the original location for that website. I am a huge novice when it comes to this so I do not even know if this is possible but I would love any help that I can get. Thank you

share|improve this question

closed as unclear what you're asking by Steve, Eric G, Gilles, Xander, John Deters Apr 18 at 4:38

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Can you clarify your question please: Please confirm that you are trying to trace the website of the third party. Which service do you use for IP Address Finder? And are you talking about the 'physical' location of the server? i.e. Looking at the Geo IP settings of the website. –  Andrew Russell Apr 16 at 21:41

3 Answers 3

Use traceroute:

traceroute <ipaddress>

on linux.

ex:

john@john-ubuntu:~$ traceroute google.com
traceroute to google.com (173.194.46.101), 30 hops max, 60 byte packets
 1  ...
 2  ...
 3  ...
 4  ...
 5  ...
 6  ...
 7  ...
 8  74.125.49.37 (74.125.49.37)  18.659 ms 205.213.119.62 (205.213.119.62)  18.648 ms  18.605 ms
 9  209.85.254.128 (209.85.254.128)  18.595 ms 209.85.254.130 (209.85.254.130)  18.516 ms  21.724 ms
10  209.85.245.225 (209.85.245.225)  18.836 ms  18.630 ms  18.617 ms
11  ord08s13-in-f5.1e100.net (173.194.46.101)  18.246 ms  18.305 ms  18.220 ms
john@john-ubuntu:~$ 

install on Ubuntu:

sudo apt-get install traceroute

Fedora:

sudo yum install traceroute

Edit:

You could also just do a whois, which might be easier:

john@john-ubuntu:~$ whois google.com

Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

...

Registry Registrant ID: 
Registrant Name: Dns Admin
Registrant Organization: Google Inc.
Registrant Street: Please contact contact-admin@google.com, 1600 Amphitheatre Parkway
Registrant City: Mountain View
Registrant State/Province: CA
Registrant Postal Code: 94043
Registrant Country: US
Registrant Phone: +1.6502530000
Registrant Phone Ext: 
Registrant Fax: +1.6506188571
Registrant Fax Ext: 
Registrant Email: dns-admin@google.com
Registry Admin ID: 
Admin Name: DNS Admin
Admin Organization: Google Inc.

Admin Street: 1600 Amphitheatre Parkway
Admin City: Mountain View
Admin State/Province: CA
Admin Postal Code: 94043
Admin Country: US
Admin Phone: +1.6506234000
Admin Phone Ext:
Admin Fax: +1.6506188571
Admin Fax Ext:
Admin Email: dns-admin@google.com
...

This should give you all the info you need!

share|improve this answer
2  
I think he wants to track original ip not proxy –  STEEL Apr 17 at 10:09

For transparent web proxies and with static tracking alone (say, your web server's access logs), you can't. The request was made to your web server from the proxy server itself, so unless it's a non-transparent proxy that attaches to web requests forwarding information, such as e.g. X-Forwarded-For HTTP header field revealing the original request's IP address, you're out of luck.

These HTTP header fields might vary by different non-transparent HTTP proxies, some of the most commonly used are: X_FORWARDED_FOR, VIA, USERAGENT_VIA, FORWARDED, PROXY_CONNECTION, XPROXY_CONNECTION, HTTP_PC_REMOTE_ADDR, HTTP_CLIENT_IP.

These might reveal anything from the public IP address of the original request, local network name, web client user agent string, and so on, depending on their implementation. Their presence alone (all of these are non-standard HTTP request fields for non-proxied connections) would however confirm your suspicions that the web requests are proxied. Of course, again, assuming the proxy isn't a transparent one that doesn't even include any of these custom header fields in its requests to your server. And sometimes, the fact that the request came from the proxy server can also be established by the request's DNS name (if it includes "proxy" in the name, then it probably is). You should also set up your server to report these values of custom HTTP fields and DNS names in your access log files, otherwise they might not even be recorded.

One other thing to add, since you're talking of coordinates, is that those are more or less useless. Exactly geolocating IP addresses is near impossible via HTTP requests, unless the clients themselves choose to allow their geolocation info to be shared via HTML 5 responses. Best you can hope for with proxied requests is establishing approximate location of the server, sometimes in which city it is in, but more commonly only in which state the IP range that server's IP belongs to was registered in. You might have better luck checking the Whois records, e.g. with the Hurricane Electric's IP address lookup tool (and there are many others available online) and perhaps be able to establish who the proxy server in question belongs to.

As for actively tracking web clients (browsers that made initial requests and revealing their true IP address), I wouldn't recommend it. It's fiddly, technically demanding and not all the fun parts of it might be legal in your country, or considered ethical. It isn't impossible, but you'll need a qualified expert for that, setting you up on your server. And it might still not work, especially if the true web clients accessing your server via a proxy aren't even proper end user browsers, but scripted web bots automating web tasks for whoever is controlling them, and relying on web APIs that don't accept browser plug-ins and extensions through which the real IP address could be revealed (say, via Flash objects), or the web client more uniquely fingerprinted for easier tracking.

In most cases, best you can do is block certain web client by user agent strings, IP addresses / IP ranges, their DNS names, or implement more in-depth checking (such as FCrDNS lookups, CBL blacklists, Honeypots and Honeynets,...) on your end, be it in web server's access rules, WAF or other firewalls,... to prevent unwelcome clients using your own resources against you. I.e. implementing a comprehensive authorization policy that would protect your assets before it hurts, instead of tilting at windmills after the fact.

share|improve this answer

Very few small companies host their websites on their own premise. Most will use webhosters with datacenters hosting between a few thousand and a few million websites. When you try to trace the IP address of a website, you will likely find the location that webhoster. When two IPs lead to the same location according to a GeoIP service, then these two IPs likely belong to the same hoster. Considering that there are hosters like GoDaddy which host tens of millions of websites, this is likely just a coincidence and doesn't mean that they are related.

When you want to find the identity behind a website, you can find out who registred the domain by using a whois service.

When you believe that the activity of the website is violating the terms-of-use of the webhoster or is even illegal, you can also file a complaint to that webhoster. The cheaper the webhoster, the more likely they are to comply with a complaint and take the website down - the few bucks they get from each customer aren't worth the trouble a complainer with a lawyer could cause them.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.