Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a website where I keep logging the user entries. I found some anonymous entries in my table and I suspect they are using some kind of proxy switchers. How can I find the real source of these intruders?

share|improve this question
I'm not familiar with the term "user entry", what are your referring to? It could be an entry in your log file or the entrance of a visitor into the site. – Stephen Ostermiller Dec 19 '13 at 10:40
What makes you think that these visitors are "intruders"? Are they somehow malicious? Almost all websites get anonymous visitors. Why would you expect to know who all your visitors are? – Stephen Ostermiller Dec 19 '13 at 10:41
@StephenOstermiller yes, i have a log which keeps user details like ip, user-agent etc. I found a number of suspicious ips from different locations of the world in a limited span of time, where my site is not meant for global users. So i suspect someone is using proxy switcher and trying to hack. – Prasanth K C Dec 19 '13 at 13:02
Hackers also use bot-nets and other hacked web sites from around the world as their base for attacks. It doesn't have to be proxies. – Stephen Ostermiller Dec 19 '13 at 13:18
@StephenOstermiller Thanks for the info, but here i am looking for a solution to find out someone using a proxy switcher. – Prasanth K C Dec 21 '13 at 9:11
up vote 2 down vote accepted

If a user is using a proxy, there may be headers in the request that you could examine or log to let you know what the original IP address of the user is. See:

If you are using Apache server, headers such as this can be logged using %{header}i, in the log format configuration directive where "header" can be any HTTP request header.

share|improve this answer

Not really possible. You can try a few clever tricks that may or may not work (caching a flash object and checking for it to identify if a user is using multiple IPs, or carefully tracking several user details and looking for matches). It's better to just make sure the site is secure versus trying to track users at all.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.