2

I suspect that an individual is masking his identity when accessing my site by power cycling his modem so his ISP assigns him new IPs.

Is there any way that I could take two different IPs that I suspect of being used by that person and get more information about them such that I can link them to each other?

Obviously they would have the same ISP and be associated with the same rough region, but this obviously isn't sufficient to make a positive ID.

Is there any way to get more specific and somehow link back to the router or anything like that?

3

Usually, the assigned IPs are in a small pool.

So you'd get 192.168.0.1, 192.168.0.37, 192.168.0.144.

There are several techniques of browser fingerprinting (you can check the EFF site for that). At the lowest level you check the user-agent. Other methods employ Javascript, Java, and Flash.

You could try to set up your website to distribute cookies and see whether they come back to you. Or you could look into supercookies.

More sneakily, you can supply some link to a site external to yours, for example a CDN link to jQuery. Most CDNs allow relaxed syntax for requesting resources, so you can ask, say,

...library.js?v=17a4&os=win7

and it won't appear suspicious. The library.js file will be downloaded and executed from a site that you do not control. Seems legit.

But what you'll be really doing is set up things so that page processing won't proceed until the library is loaded. And that version number is only sent to guys from that specific network. And in the rest of the page you have another resource that needs loading.

Unless the guy also clears the cache, the next time your page loads it won't even ask for that library, or it will satisfy itself with a 304 Not Modified. So an unknown new guy will take say 400 milliseconds from HTML request to tracking resource. A guy with primed cache, even with different IP, will take 150 milliseconds. And you can set up more than one script with this trick.

You know that the guy is the same as before, because no other guy got that specific fake version number '17a4'.

Similarly, you can have several random thumbnails in one page and see whether the client is requesting them all. If some of them aren't requested (which means the client has them in cache), you can look into a database to whom you served that particular, unique combination of thumbnails (or fake ads, for that matter).

In Javascript you can also access local browser storage; you can use that to store what amounts to a "cookie" that will survive cache clearing (but not local storage clearing).

0

Maybe not the best answer, but you can get is hostname instead of the IP adress.http://www.whatsmyip.org/ for example will provide you that information and thus give you a better idea of who this client is.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.