This is the most common version you will see. It shows that the request has been routed through a server we trust (so will be invisible to Wikipedia), and we can see the real origin of the request. This is likely where the request came from originally.
| (trusted) | 91.198.174.197 | turnera-ext-bge0.toolserver.org |
| (origin) | 3.4.5.6 | Talk page | Local Contributions | Deleted Edits | Global Contributions | Local Blocks | Local Range Blocks | Global Blocks | Global Range Blocks | Whois | Geolocate | Abuse Filter Log | SIL | CheckUser |
This is a version you may also see occasionally.
| (trusted) | 91.198.174.197 | turnera-ext-bge0.toolserver.org |
| (untrusted) | 1.2.3.4 | Talk page | Local Contributions | Deleted Edits | Global Contributions | Local Blocks | Local Range Blocks | Global Blocks | Global Range Blocks | Whois | Geolocate | Abuse Filter Log | SIL | CheckUser |
| (origin untrusted) | 2.3.4.5 | Talk page | Local Contributions | Deleted Edits | Global Contributions | Local Blocks | Local Range Blocks | Global Blocks | Global Range Blocks | Whois | Geolocate | Abuse Filter Log | SIL | CheckUser |
Here, the request has been proxied (in reverse order) through the Toolserver (a server we trust) from an untrusted server at 1.2.3.4.
The untrusted server at the IP 1.2.3.4 claims it has also proxied the request from a client at 2.3.4.5, however, since we don't trust that server, we don't trust what it claims.
The IP address which will be visible on Wikipedia will be 1.2.3.4, as that is where the chain loses trust.
Here's a slightly more complicated example.
| (trusted) | 91.198.174.204 | damiana-ext-bge0.toolserver.org |
| (trusted) | 178.79.155.110 | metapod.lon.stwalkerster.net |
| (untrusted) | 4.5.6.7 | Talk page | Local Contributions | Deleted Edits | Global Contributions | Local Blocks | Local Range Blocks | Global Blocks | Global Range Blocks | Whois | Geolocate | Abuse Filter Log | SIL | CheckUser |
| (via untrusted) | 178.79.183.147 | Talk page | Local Contributions | Deleted Edits | Global Contributions | Local Blocks | Local Range Blocks | Global Blocks | Global Range Blocks | Whois | Geolocate | Abuse Filter Log | SIL | CheckUser |
| (origin untrusted) | 5.6.7.8 | Talk page | Local Contributions | Deleted Edits | Global Contributions | Local Blocks | Local Range Blocks | Global Blocks | Global Range Blocks | Whois | Geolocate | Abuse Filter Log | SIL | CheckUser |
Here we can see that the request has been routed through two trusted servers - the toolserver and one of stwalkerster's servers. The next server in the list, 4.5.6.7, we don't trust, so that's the address that will appear on Wikipedia. However, the next one, we do trust, but since a server we don't trust is reporting it, we don't trust it this time (hence "via untrusted").
We can also see that the servers are claiming the origin of the request is 5.6.7.8, which we can't trust to be true.
As with the others above, the IP Wikipedia will see, and hence the IP we should be concentrating checks on, is the first "untrusted" one (4.5.6.7).