I usually use
tracert to get IP-addresses for domains or sub domains and it works really well. However I have stumbled upon a site that seems to use a reverse proxy or something similar because one request to a sub directory generates different server-header and a lot of security headers are not implemented there. See example requests below. I was hoping for
X-Forwarded-For header for the sub site but no luck there.
My question is if it is possible to get the IP of that server?
GET / HTTP/1.1 Host: www.site1.com
HTTP/1.1 200 OK Date: Tue, 07 Feb 2017 09:12:36 GMT Server: Apache Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 19 Nov 1981 08:52:00 GMT Pragma: no-cache X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Frame-Options: deny Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
GET /site2/ HTTP/1.1 Host: www.site1.com
What I have tried, even though I knew it would not work.
Ping request could not find host www.site1.com/site2. Please check the name and try again.
Unable to resolve target system name www.site1.com/site2.