What is a reverse proxy?¶
A reverse proxy is a public-facing intermediary that receives user requests and forwards them to another server or service behind it. Its address identifies the intermediary, not necessarily the origin host or operator.
Reverse proxies may:
- balance traffic;
- provide encryption;
- filter malicious requests;
- cache content;
- improve security; and
- conceal the origin server from direct exposure.
CDNs often include reverse-proxy functions, but the terms are not identical.
Investigative significance¶
The address seen in DNS or connection records may belong to the reverse-proxy provider and may be shared by many unrelated sites.
The provider may nevertheless hold:
- customer-account details;
- configuration information;
- security events;
- traffic records; and
- details of where requests were forwarded.
The origin host or platform may hold different content and administrator records.
Avoid intrusive action¶
Historic DNS, provider records, linked services and other evidence may reveal the origin infrastructure. Do not attempt to bypass protective services in a way that risks altering evidence or interfering with the system. Seek specialist support where necessary.
Key takeaway
Treat the reverse proxy as one layer in the evidence chain. Identify the intermediary, then trace the origin and customer relationship through appropriate records.