How To See Where Your Business Imposter Is Located

Your business’s reputation is its most valuable asset.

But what happens when someone steals your name to scam your customers? Or starts to attack you directly?

You don’t have to wait for law enforcement to step in just yet - you can start to play detective yourself!

While you may not be able to find the exact address, you can trace digital activity and spot suspicious patterns to understand where the breach is coming from.

What Is The Point Of Tracking Locations?

Tracking the digital footprint of a business imposter is something that you can do (or hire a private investigator to do) to understand what is happening, before you further report the situation to law enforcement.

Here is why knowing where your attacker is located matters:

• Know how high risk the threat is

  Is the attacker operating from a foreign country with little chance of legal recourse, or is from a competitor down the street?

• Be able to build a legal case later

  If you need to file a police report or a lawsuit, knowing someone’s location gives investigators a starting point.

• Strengthen your security

  If you can identify patterns (ex: geographic region, time zones, etc.), you can take local action, such as blocking traffic from that specific area.

• Prevent financial loss

  If you can identify fraudulent login attempts or fake orders from suspicious locations, you can cancel transactions before money actually goes missing.

How To Track Locations

Tracking an imposter involves looking at digital clues they leave behind. Keep in mind that while an IP address is the best starting point, people may use VPNs that block their real location.

Still, there’s nothing you can do but to try.

Here is how to track an IP address.

First of all, let’s explain what IP address means.

Think of an IP address like your house’s mailing address, but for the internet.

Every single device (your phone, your laptop, the imposter’s computer) needs an IP address to talk to other devices online. Without it, the internet wouldn’t know where to send the emails you write or the websites you visit.

An IP address is just a string of numbers, looking something like this: 172.16.254.1.

That string of numbers can show, among other things:

• a general physical location, like a city or a general neighborhood

• whether the connection looks like a home network or VPN

• the internet provider

You can only track an IP address from activity connected to your business, like emails you received, your website, or your own accounts.

It’s important to understand that IP addresses can change, and many people use tools that hide their real location. That’s why IP addresses are best used as one piece of information, not the final proof.

1. Find the string of numbers.

   • From their email:

     Open the email sent by the imposter → view the email headers → look for a line labeled “Received”

     (Most email providers like Gmail or Outlook have a “Show original” or “View headers” option. This reveals the network the email was sent from.)

   • From their fake website:

     Visit the fake website → check your security tools or traffic logs for visits tied to reported activity

     (Many hosting providers and security tools show visitor IP addresses connected to form submissions or page access.)

   • From account impersonation attempts:

     Review login alerts → open your platform’s security or access history

     (Platforms like Google, Meta, and Shopify record IP addresses and locations for every login attempt.)

2. Use an IP lookup tool.

   Once you have the IP address, paste it into a public IP lookup website.

   Here are some free ones: IPinfo | IPlocation.net | Geo Data Tool

3. Find the patterns.

   Look for things like:

   • The same country or region appearing over and over

   • The same internet provider or hosting company

   • Repeated use of VPNs or data centers

   • Activity happening at the same times each day

   These patterns help you understand whether the impersonation is coming from:

   • One person

   • A small group

   • Or an automated system

   Consistency is the key. If the same details keep showing up across emails, logins, or messages, you’re likely dealing with the same source, even if the IP address itself changes.

What To Do After You Find The Location

Once you’ve identified where suspicious activity is coming from (or noticed clear patterns), the goal isn’t to confront anyone. The goal is to deescalate & reduce risk.

1. Document everything.

2. Secure all of your accounts (change passwords, enable two-factor authentication, review user access).

3. Monitor for repeated activity, which shows that securing your accounts didn’t help to stop the imposter.

4. Report on the platforms first (social media, website, forums, etc).

5. If the activity continues, you can escalate it to an investigator or report it to the authorities.