A good number of websites these days are not served directly over the internet, but through an intermediate providers, such as Cloudflare and Incapsula.
A basic premise of the security provided by these services involves not revealing the original IP of the server. Websites often leak their IP through MX records or through "direct" DNS records.
We'll now assume a website which does not leak its IP through such common techniques. The website, however, has some form of an URL traversal functionality controlled by the user, such as:
- A website screenshot service
- Generation of "link cards" on social networking websites
- "Redirect checker" websites
Now, all the attacker needs to do is to type in an URL pointing to his own server and observe the server's request log. In the case of the "screenshot" services, it is even more trivial to do so: the attacker simply needs to point it to one of the "What is my IP" websites, and voilà: they have your IP.
What set of mitigations can be used to handle this IP leakage effectively?