A friend of mine was recently being harassed on Instagram, with the person claiming to know her and saying he'd let her know if he saw her on a night out. To help her out, I used grabify IP tracker to create a link, which she sent to him and he opened twice - the first time directly from Instagram DM, the second copy and pasted into their phone browser.

As I suspected, the IP came back to someone in the US (we live in the UK), so it wasn't anyone she knew at all. However, I noticed that the IP addresses on each click were slightly different and she thinks it's because he's using a VPN.

The first IP address was xxx.xxx.115.38 (opening via Instagram)

The second was xxx.xxx.99.18, pasted into the browser.

The xxx.xxx part of the IP addresses are the same.

Why would they be different, and could it be that they are using VPN and it is someone that she knows?

  • It might just be that the user is working from a mobile device. – Stephane Aug 7 '18 at 12:01
  • @Stephane so if they were sat at a desk in their home and opened it once on their phone, then opened it a second time sat in the same location just a minute or so after, they'll have a different IP address? An IP tracker located both to the same place in the US, but it just seemed odd they were different IP addresses. – David Aug 7 '18 at 12:04
  • 1
    They will have different IP addresses if they use different networtks (GSM vs Wifi). if they have one provider for both broadband and GSM, then what you're seeing is very possible. – Stephane Aug 7 '18 at 13:30
  • Grabify has built in VPN detection, so it will alert you if it detects a VPN. - Disclaimer: I am the creator – jLynx Sep 17 at 0:19

Google Chrome on Android has a Data saver feature that proxies requests through googles servers. Other browsers may have similar features.

You can't really glean much information from just the IP. Looking at whois for the IP would give you a bit more information. If it's from googles proxies, they will probably have googles contact info in the whois.

  • Okay thanks. I checked whois and it gave the same result as in the IP tracker I used, in terms of where the IP address is located geographically, so I'll assume that is where they're located and the troll isn't someone who can actually physically harm my friend. Thanks again! – David Aug 7 '18 at 16:30
  • 1
    @David, you can't assume that. Just an IP doesn't give enough information to prove or disprove use of a VPN. – Karl Bielefeldt Aug 7 '18 at 20:40
  • Grabify has built in VPN detection, so it will alert you if it detects a VPN. - Disclaimer: I am the creator – jLynx Sep 17 at 0:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.