I usually use ping or tracert to get IP-addresses for domains or sub domains and it works really well. However I have stumbled upon a site that seems to use a reverse proxy or something similar because one request to a sub directory generates different server-header and a lot of security headers are not implemented there. See example requests below. I was hoping for X-Real-IP or X-Forwarded-For header for the sub site but no luck there.

My question is if it is possible to get the IP of that server?


GET / HTTP/1.1
Host: www.site1.com


HTTP/1.1 200 OK
Date: Tue, 07 Feb 2017 09:12:36 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: deny
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Connection: close


GET /site2/ HTTP/1.1
Host: www.site1.com


HTTP/1.1 200 OK
Date: Tue, 07 Feb 2017 10:20:10 GMT
Server: Apache-Coyote/1.1
Content-Type: text/javascript;charset=utf-8
Content-Length: 242
Connection: close

What I have tried, even though I knew it would not work.

ping www.site1.com/site2

Ping request could not find host www.site1.com/site2. Please check the name and try again.

tracert www.site1.com/site2

Unable to resolve target system name www.site1.com/site2.

  • 4
    Why do you want the IP address? Why do you think the other server even has a public IP address? – Sjoerd Feb 7 '17 at 11:21
  • @Sjoerd I'm not sure if the IP is public but I would still like to know if there is a way to get either the public or the internal IP. I'm curious if it is technically possible. I think not but I would love to be proven wrong. – Ogglas Feb 7 '17 at 11:25

This is not possible, unless the (or every) site behind the proxy leaks its IP address somehow, usually in headers when sent special requests (it is surprisingly common but far from ubiquitous) - exchange autodiscover springs to mind. The application running on the server would have to be vulnerable to this.

There are leaks of information for example how many sites are behind load balancers using IP ID information disclosures, but not the address

Or the load balancers/proxies can disclose this information in some cases due to the cookies they use for connection tracking.

I'm not aware of any built in tools or the like. And has been commented - the chances are these will be behind a DMZ on a LAN on private address ranges, though again, not necessarily.


One option would be to send your request to all IP addresses you'd like to test and see if any respond.

For example, send the following request to all IP addresses in subnet where www.site1.com resides. Expanding your scope of IP addresses maybe necessary as the destination server may not reside on the same subnet.

GET /site2/ HTTP/1.1
Host: www.site1.com

There are caveats with this approach:

  1. Backend web server may only be accessible via the frontend web server. In your case the frontend web server is the reverse proxy.
  2. The backend web server may be configured to use alternate ports. Again it could only be accessible via the frontend otherwise the alternate port would need to be identified.

Try this

You might try to use nmap to scan the site. With nmap you can fragment, decoy and apply many other things to your packets to bypass firewalls and other things that may be preventing your packets from getting through to the site. Hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.