I was researching digital goods and security when I stumbled upon this company. One of the services they provide is "Real IP". They claim to be able to get the real IP address of users even when they are behind a proxy. There are several reasons companies and end-users use proxies, one is for privacy another for security. So, I was curious. Other than installing an application that ignores system configurations to use proxies, how could one get the "real IP" address of someone using a proxy?
With the ease of setting up and joining/using proxying services (especially those specializing in providing anonymity, such as Tor), it would be impossible for any company to legitimately claim to be able to "unmask" someone behind a proxy based on having some kind of relationship with ISPs and proxy services, to say nothing of the sheer volume of those and how monumental a task it would be to form those relationships in the first place.
This is combined with a giant database to determine what level of "threat" a user poses, but the ultimate end result is that they are using one or more code objects that execute on the client's browser, which does indeed bypass proxies and can indeed determine the "real" IP behind them.
Another trick is to use DNS. If you control the DNS server for your domain then you can see all requests coming in.
By creating a unique subdomain address for each visitor and embedding it somewhere in the HTML, you can check the client's real IP on the DNS server.
This will work so long as the client doesn't masquerade DNS.