A friend of mine was recently being harassed on Instagram, with the person claiming to know her and saying he'd let her know if he saw her on a night out. To help her out, I used grabify IP tracker to create a link, which she sent to him and he opened twice - the first time directly from Instagram DM, the second copy and pasted into their phone browser.
As I suspected, the IP came back to someone in the US (we live in the UK), so it wasn't anyone she knew at all. However, I noticed that the IP addresses on each click were slightly different and she thinks it's because he's using a VPN.
The first IP address was xxx.xxx.115.38 (opening via Instagram)
The second was xxx.xxx.99.18, pasted into the browser.
The xxx.xxx part of the IP addresses are the same.
Why would they be different, and could it be that they are using VPN and it is someone that she knows?