I was researching digital goods and security when I stumbled upon this company. One of the services they provide is "Real IP". They claim to be able to get the real IP address of users even when they are behind a proxy. There are several reasons companies and end-users use proxies, one is for privacy another for security. So, I was curious. Other than installing an application that ignores system configurations to use proxies, how could one get the "real IP" address of someone using a proxy?


  • My guess? They probably ask the host system for their IP or possibly ping the system on its connection. Not very useful when the "real IP" reported is or something. – Broam May 17 '11 at 20:52
  • A couple more ideas came to mind, but seem improbable. They could either become a major provider of proxy services or have established deals with major ISPs to correlate data. Both tactics would be rather "sneaky" to say the least. – Michael Prescott May 17 '11 at 21:01
  • iovation.com/press-release-021511: ... "the largest device reputation repository on the planet, including shared intelligence on half a billion devices and their associations". You're probably not too far off. – Mat May 17 '11 at 21:28
  • 3
    People that are serious about anonymity generally use things like onion routing through a bundled browser within a vm with a spoofed user agent. It takes very little to set up and, if done properly, it's nearly impossible to unmask. – Blomkvist May 17 '11 at 21:43

With the ease of setting up and joining/using proxying services (especially those specializing in providing anonymity, such as Tor), it would be impossible for any company to legitimately claim to be able to "unmask" someone behind a proxy based on having some kind of relationship with ISPs and proxy services, to say nothing of the sheer volume of those and how monumental a task it would be to form those relationships in the first place.

Most likely what they do is utilize a Flash or Java applet, or a bit of JavaScript, which would "go directly to the source to learn the true IP". This is the most common method of "unmasking" proxied users, and according to at least one of the white papers on their site (registration required, but you can use a throwaway e-mail and bogus info; I picked their "online community" one at random), this is exactly what they do:

Software Downloads and Web Technologies: Software downloads such as ActiveX and Web technologies for cookies, flash-stored objects and java script leverage IP addresses, geo-location and other non-unique identifiers to recognize or re-recognize a device every time it creates an online account.

This is combined with a giant database to determine what level of "threat" a user poses, but the ultimate end result is that they are using one or more code objects that execute on the client's browser, which does indeed bypass proxies and can indeed determine the "real" IP behind them.

That this makes it "difficult to hide" is, however, false -- it is pretty darned easy to disable JavaScript, Flash, Java, ActiveX (to say nothing of using a browser that doesn't support that in the first place), or to even install a simple application like Privoxy which can prevent these things from even reaching your browser in the first place. Combined with an onion routing network like Tor and this "hardened" browser running inside of a VM (which, as @Blomkvist commented above, is easy to get and use), it's all but impossible to determine the real IP of a user (to say nothing of the question: "What is someone's "real IP" if they are running a NAT'ed VM on a host inside a private network on an ISP that itself uses NAT for its customers" -- that's 3 different private IPs that "belong" to that user, yet none reveals any information about said user!).


Another trick is to use DNS. If you control the DNS server for your domain then you can see all requests coming in.

By creating a unique subdomain address for each visitor and embedding it somewhere in the HTML, you can check the client's real IP on the DNS server.

This will work so long as the client doesn't masquerade DNS.

  • 1
    Works only if the visitor is not using a SOCKS proxy (which proxies DNS requests as well), in addition to requiring you to have control of your DNS server. – Kromey May 18 '11 at 0:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.