What does a proxy do to the IP address a service sees?¶
A proxy is an intermediary. A service that receives traffic from the proxy may record the proxy's address rather than the address of the earlier connection.
The short version¶
A proxy changes the observation point. It does not make the earlier connection, account or activity disappear.
The route¶
A simple route looks like this:
device or connection → proxy → online service
The online service records the connection arriving from the proxy. The proxy may record the connection arriving from the device or earlier network. Those are different records created at different points.
A useful analogy
A proxy is like a forwarding desk. The recipient sees the desk that delivered the item; the desk may hold a record of who handed it over. The analogy stops there because network records, retention and legal access vary between services.
What the service may record¶
The destination service may see:
- the proxy's public IP address;
- the time and connection details;
- an account, session or request;
- application data such as messages or uploads; and
- a forwarded address field, if the service is configured to receive one.
Do not assume a forwarded field is reliable without knowing which trusted system created it.
What the proxy may record¶
Depending on the service and retention, the proxy may hold:
- the connecting address;
- time and duration;
- source and destination ports;
- account or authentication details; and
- the onward destination.
The existence, accuracy and availability of these records must be established. A proxy address does not prove that useful proxy records exist.
What the address does not establish¶
A proxy IP does not by itself identify:
- the originating device;
- the person using it;
- the account controller; or
- the person responsible for the activity.
It identifies what the destination service saw at its observation point.
A worked interpretation¶
The platform recorded 203.0.113.44 during the message event. Registration information associates that address with a proxy service. The platform record therefore identifies the service-side observation point; it does not by itself identify the originating user.
See what records might exist for this infrastructure and what the observation system could see.
The point to remember
A proxy can hide the earlier source from the destination service, but it replaces one visible connection with another. Interpret the address from the system that recorded it.
