if he is a beginner, then the chance is very small that he will be able to set everything up correctly and at the same time pay for each step (VPNs must be different, otherwise there will be no point)
Most likely, he has his IP address because he set up incorrectly or free VPNs.
For a beginner and a little higher than a beginner, the following combination is suitable:
VPN (paid, no logs) to the main OS, after which anti-detect (I personally use ADSpower, undetectable, okto browser), socks 5 clean and that's it.
Beforehand, you need to check the VPN for DNS leakage
browserscan.net
What's my IP address, how to find and check my IP address. Two versions of anonymity check: light and extended
whoer.net
To check socks 5 for purity, the most relevant sites are
ipqualityscore.com
fv.pro
Lookup any IP address to fraud check that IP. Check the fraud score, view supporting information including true country, operator, proxy status, and Tor status.
scamalytics.com
browserscan.net