Man
Professional
- Messages
- 3,077
- Reaction score
- 614
- Points
- 113
It's not that you shouldn't try to hide your IP address. It's that it's absolutely pointless if you don't understand other aspects of anonymity.
Hello, dear friends! I often get questions about how to set up a "Tor + VPN from Tails" bundle or how to use a "VPN → Tor → VPN" chain. The main purpose of such constructions is to ensure your anonymity.
But at the same time, many who ask such questions are too focused on changing their IP and completely forget about much more important things.
From personal experience, I know of a case where a fairly experienced carder used fake SIM cards, disposable emails, VPN, and transferred money through a chain of payment systems and fake phones. That is, he tried his best, but he was caught.
It's not that you shouldn't try to hide your IP address, it's just that it's absolutely pointless if you don't understand other aspects of anonymity.
Next, I'll tell you about typical mistakes that lead to deanonymization. Many of them may seem idiotic to you. But people do make them! Partly, due to ignorance of technical aspects, partly, simply forgetting about much more important things than setting up 2 VPNs through 3 Tors and 8 proxies.
1. Anonymity in social networks
If you registered in FB (a social network), indicating your phone number, and then connected to FB via Tor, in order to write in the official group of the Zadrishchensk City Administration: "Second convocation deputy of the city council Nikiforov S.S. is a thief."
Does this mean that you are anonymous - after all, you used Tor?
No, it doesn't. At least because your social network account is linked to a real phone number. Accordingly, your IP address is not particularly necessary for your identification.
2. Anonymity and Cookies
Cookies are small pieces of information that are stored in your web browser after the site has sent them to you.
If you went to a site, received your cookies, then reconnected via Tor and wrote something like: “Second convocation city council deputy D.S. Petrov is also a thief” in the comments, then the cookie can link the author of the comment and the user who previously logged in with a different IP address.
Cookies are designed to identify the user regardless of your IP address.
3. Many sites store the IP of previous actions
For example, you registered a VPN account to which you will connect via Tor. But you registered from your IP (because Tor is slow, and anyway, that site does not accept connections from the Tor network).
Will you be anonymous if you connect to a VPN through Tor?
No, because information about previous transactions with the IP address has already been saved.
4. I will buy a VPN (or a VPS server to set up OpenVPN) and will be anonymous
Even if you read the third point and went to register through Tor, but at the same time use wallets that can lead to you, then there is no talk of any anonymity.
️ Moreover, when buying disposable SIM cards and when entering wallet sites, you also need to remember about your anonymity, otherwise it is all simply pointless.
5. OpenVPN is very good, but not for anonymity
If you remember the original purpose of VPN networks, it turns out that virtual private networks, within which computers scattered around the world can access each other's local network resources. In this case, the exchange of traffic occurs in encrypted form, but this traffic is encrypted only for an external observer, but not for the server and clients of the OpenVPN network.
For this reason, if you purchased a free or paid VPN account, then be prepared that the server owner can do ANYTHING with your traffic and keeps activity logs - which requests were made from which client. How many of them are "honeypots" (traps) and record activity - it is impossible to say, but in my opinion, 100% of paid and free VPN providers do this.
If you want to use a VPN - use it, but your own.
6. There are 1001 ways to find out your real IP address
There are a huge number of options. From the simplest - send a link to a controlled site and look at the IP (if communication is via an anonymous messenger) or a file with a Trojan to quite sophisticated methods.
7. If you use any closed-source software for illegal activities, then there is 100% a backdoor installed there
Backdoors can also be in legitimate closed-source software - as a difficult-to-detect vulnerability that the manufacturer knows about, or just a regular, dumb-as-a-cork backdoor - such were found, for example, in official router firmware.
As for illegal closed-source software that is distributed anonymously, please tell me, why not install a backdoor there? The owner will not know anything, and even if he does, what will he do? He will go to the police and say: I bought scripts to hack the protection of stolen phones, and they installed a virus there... I doubt he will do that.
8. Misunderstanding of the simplest technical aspects of networks, servers, applications, accumulated and available information in open sources
Phishing sites of some uneducated "carders" can be easily found by simply analyzing where the POST request goes.
Why did the "carder" leave scripts in the archive on this site? Apparently, he simply did not know that it is very easy to track where the POST request goes even if the HTML code is obfuscated.
And there can be many such "technical" blunders: a simple SSH connection password ("nobody knows where my server is"), misunderstanding what information on the server the researcher can access, misunderstanding what Cloudflare is for, etc.
9. The big picture
Example: infrastructure objects are attacked and IP traces and other indirect signs lead somewhere far away. But at the same time, the objects and methods of attack are similar to those used by a well-known carder group.
At least, there is a reason to think.
10. Metadata in files
You should know everything about metadata and programs for viewing and cleaning it.
Otherwise, if you distribute files, all other anonymity measures may become useless. Approximately as in the first point, when Tor is used, but you log in to the social network under your account.
What should I do to make sure I am not found?
The only 100% guarantee is the fact that they will not look for you ...
A cowboy on a horse is prancing in the square ... - Who is it? - Elusive Joe. - And what, really no one can catch him? - Who the hell needs him! Even if you have studied the "manuals on anonymity" from cover to cover, even if it is written by an understanding person and even if you did everything correctly, but at the same time do not understand other aspects discussed above, then your chances of "getting caught" in one of the idiotic ways discussed above are quite high.
Hello, dear friends! I often get questions about how to set up a "Tor + VPN from Tails" bundle or how to use a "VPN → Tor → VPN" chain. The main purpose of such constructions is to ensure your anonymity.
But at the same time, many who ask such questions are too focused on changing their IP and completely forget about much more important things.From personal experience, I know of a case where a fairly experienced carder used fake SIM cards, disposable emails, VPN, and transferred money through a chain of payment systems and fake phones. That is, he tried his best, but he was caught.
It's not that you shouldn't try to hide your IP address, it's just that it's absolutely pointless if you don't understand other aspects of anonymity.Next, I'll tell you about typical mistakes that lead to deanonymization. Many of them may seem idiotic to you. But people do make them! Partly, due to ignorance of technical aspects, partly, simply forgetting about much more important things than setting up 2 VPNs through 3 Tors and 8 proxies.
1. Anonymity in social networks
If you registered in FB (a social network), indicating your phone number, and then connected to FB via Tor, in order to write in the official group of the Zadrishchensk City Administration: "Second convocation deputy of the city council Nikiforov S.S. is a thief."
Does this mean that you are anonymous - after all, you used Tor? No, it doesn't. At least because your social network account is linked to a real phone number. Accordingly, your IP address is not particularly necessary for your identification.2. Anonymity and Cookies
Cookies are small pieces of information that are stored in your web browser after the site has sent them to you.
If you went to a site, received your cookies, then reconnected via Tor and wrote something like: “Second convocation city council deputy D.S. Petrov is also a thief” in the comments, then the cookie can link the author of the comment and the user who previously logged in with a different IP address. Cookies are designed to identify the user regardless of your IP address.3. Many sites store the IP of previous actions
For example, you registered a VPN account to which you will connect via Tor. But you registered from your IP (because Tor is slow, and anyway, that site does not accept connections from the Tor network).
Will you be anonymous if you connect to a VPN through Tor? No, because information about previous transactions with the IP address has already been saved.4. I will buy a VPN (or a VPS server to set up OpenVPN) and will be anonymous
Even if you read the third point and went to register through Tor, but at the same time use wallets that can lead to you, then there is no talk of any anonymity.️ Moreover, when buying disposable SIM cards and when entering wallet sites, you also need to remember about your anonymity, otherwise it is all simply pointless.5. OpenVPN is very good, but not for anonymity
If you remember the original purpose of VPN networks, it turns out that virtual private networks, within which computers scattered around the world can access each other's local network resources. In this case, the exchange of traffic occurs in encrypted form, but this traffic is encrypted only for an external observer, but not for the server and clients of the OpenVPN network.
For this reason, if you purchased a free or paid VPN account, then be prepared that the server owner can do ANYTHING with your traffic and keeps activity logs - which requests were made from which client. How many of them are "honeypots" (traps) and record activity - it is impossible to say, but in my opinion, 100% of paid and free VPN providers do this.
If you want to use a VPN - use it, but your own.6. There are 1001 ways to find out your real IP address
There are a huge number of options. From the simplest - send a link to a controlled site and look at the IP (if communication is via an anonymous messenger) or a file with a Trojan to quite sophisticated methods.
7. If you use any closed-source software for illegal activities, then there is 100% a backdoor installed there
Backdoors can also be in legitimate closed-source software - as a difficult-to-detect vulnerability that the manufacturer knows about, or just a regular, dumb-as-a-cork backdoor - such were found, for example, in official router firmware.
As for illegal closed-source software that is distributed anonymously, please tell me, why not install a backdoor there? The owner will not know anything, and even if he does, what will he do? He will go to the police and say: I bought scripts to hack the protection of stolen phones, and they installed a virus there... I doubt he will do that.
8. Misunderstanding of the simplest technical aspects of networks, servers, applications, accumulated and available information in open sources
Phishing sites of some uneducated "carders" can be easily found by simply analyzing where the POST request goes.
Why did the "carder" leave scripts in the archive on this site? Apparently, he simply did not know that it is very easy to track where the POST request goes even if the HTML code is obfuscated. And there can be many such "technical" blunders: a simple SSH connection password ("nobody knows where my server is"), misunderstanding what information on the server the researcher can access, misunderstanding what Cloudflare is for, etc.9. The big picture
Example: infrastructure objects are attacked and IP traces and other indirect signs lead somewhere far away. But at the same time, the objects and methods of attack are similar to those used by a well-known carder group.
At least, there is a reason to think.10. Metadata in files
You should know everything about metadata and programs for viewing and cleaning it.
Otherwise, if you distribute files, all other anonymity measures may become useless. Approximately as in the first point, when Tor is used, but you log in to the social network under your account.What should I do to make sure I am not found?
The only 100% guarantee is the fact that they will not look for you ...
A cowboy on a horse is prancing in the square ... - Who is it? - Elusive Joe. - And what, really no one can catch him? - Who the hell needs him! Even if you have studied the "manuals on anonymity" from cover to cover, even if it is written by an understanding person and even if you did everything correctly, but at the same time do not understand other aspects discussed above, then your chances of "getting caught" in one of the idiotic ways discussed above are quite high.
