[LINK] technical question: security alert

[Scott Howard]

On Wed, Mar 4, 2009 at 8:56 AM, Kim Holburn <kim.holburn at gmail.com> wrote:

> Actually, if you use a ISP with a proxy or it unknown to you has a
> transparent proxy this probably won't give you your IP.


Most ISPs using transparent proxies also do "IP Spoofing" so that the
packets hitting the website will appear to come from your IP address (ie,
that of your NAT/ADSL link/etc) even though they actually don't.

Corporates/etc generally won't do this so the IP addressof the connection
will be that of the proxy itself, or (more likely) your NAT IP as that's
normally after the proxy.

Because it seems to be the day of posting your own IP checkers,
http://ip.zsdemo.com adds something that most don't, which is that it
explicitly differentiates between the IP address the request is received
from, and the IP address in the X-forwarded-for header which many
non-IP-spoofing proxies add in (if one exists).  Most other sites will
display one or the other, and it's often not clear which they are using.

  Scott.