I work for a small company who has troubles with third parties selling our products on Amazon. Sometimes those third parties have websites and when I use an IP address finder online it gives me coordinates to what I think is a proxy server because there has been a few times where I enter different IP addresses but I get the same coordinates. Is there a way that I can go through the proxy server and find the original location for that website. I am a huge novice when it comes to this so I do not even know if this is possible but I would love any help that I can get. Thank you
closed as unclear what you're asking by Steve, Eric G, Gilles, Xander, John Deters Apr 18 '14 at 4:38
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
install on Ubuntu:
You could also just do a whois, which might be easier:
This should give you all the info you need!
For transparent web proxies and with static tracking alone (say, your web server's access logs), you can't. The request was made to your web server from the proxy server itself, so unless it's a non-transparent proxy that attaches to web requests forwarding information, such as e.g.
These HTTP header fields might vary by different non-transparent HTTP proxies, some of the most commonly used are:
These might reveal anything from the public IP address of the original request, local network name, web client user agent string, and so on, depending on their implementation. Their presence alone (all of these are non-standard HTTP request fields for non-proxied connections) would however confirm your suspicions that the web requests are proxied. Of course, again, assuming the proxy isn't a transparent one that doesn't even include any of these custom header fields in its requests to your server. And sometimes, the fact that the request came from the proxy server can also be established by the request's DNS name (if it includes "proxy" in the name, then it probably is). You should also set up your server to report these values of custom HTTP fields and DNS names in your access log files, otherwise they might not even be recorded.
One other thing to add, since you're talking of coordinates, is that those are more or less useless. Exactly geolocating IP addresses is near impossible via HTTP requests, unless the clients themselves choose to allow their geolocation info to be shared via HTML 5 responses. Best you can hope for with proxied requests is establishing approximate location of the server, sometimes in which city it is in, but more commonly only in which state the IP range that server's IP belongs to was registered in. You might have better luck checking the Whois records, e.g. with the Hurricane Electric's IP address lookup tool (and there are many others available online) and perhaps be able to establish who the proxy server in question belongs to.
As for actively tracking web clients (browsers that made initial requests and revealing their true IP address), I wouldn't recommend it. It's fiddly, technically demanding and not all the fun parts of it might be legal in your country, or considered ethical. It isn't impossible, but you'll need a qualified expert for that, setting you up on your server. And it might still not work, especially if the true web clients accessing your server via a proxy aren't even proper end user browsers, but scripted web bots automating web tasks for whoever is controlling them, and relying on web APIs that don't accept browser plug-ins and extensions through which the real IP address could be revealed (say, via Flash objects), or the web client more uniquely fingerprinted for easier tracking.
In most cases, best you can do is block certain web client by user agent strings, IP addresses / IP ranges, their DNS names, or implement more in-depth checking (such as FCrDNS lookups, CBL blacklists, Honeypots and Honeynets,...) on your end, be it in web server's access rules, WAF or other firewalls,... to prevent unwelcome clients using your own resources against you. I.e. implementing a comprehensive authorization policy that would protect your assets before it hurts, instead of tilting at windmills after the fact.
Very few small companies host their websites on their own premise. Most will use webhosters with datacenters hosting between a few thousand and a few million websites. When you try to trace the IP address of a website, you will likely find the location that webhoster. When two IPs lead to the same location according to a GeoIP service, then these two IPs likely belong to the same hoster. Considering that there are hosters like GoDaddy which host tens of millions of websites, this is likely just a coincidence and doesn't mean that they are related.
When you want to find the identity behind a website, you can find out who registred the domain by using a whois service.
When you believe that the activity of the website is violating the terms-of-use of the webhoster or is even illegal, you can also file a complaint to that webhoster. The cheaper the webhoster, the more likely they are to comply with a complaint and take the website down - the few bucks they get from each customer aren't worth the trouble a complainer with a lawyer could cause them.