VPN PROXY IP TRACKER

Shivanshu Rana Udit Mishra

Department of Computer Science and Department of Computer Science and
Engineering Engineering
Sharda University,Greater Noida Sharda University,Greater Noida

Rahul Bhandari Dr.sandeep Kumar

Department of Computer Science and Department of Computer Science and
Engineering Engineering
Sharda University,Greater Noida Sharda University,Greater Noida

ABSTRACT
Cybercriminals use a variety of The number of people staying at home a
techniques to steal their digital s a service has turned into a new gray m
footprints, which creates challenges for arket area where service providers gain
law enforcement to catch and prosecute ownership (intervention) in residential a
them. It knows when the machine tries reas. Provide community anonymous se
to connect to the target in a different rvices, effectively hiding their clients' IP
way. The victim's machine only sees addresses from others, such as regular I
requests from the "proxy" or VPN P addresses (RESIP) addresses.Cyberatt
server. Now, since the VPN hides the IP acks are on the rise, and since the Covid
address, it causes the network to be 19 pandemic, the world has recorded th
redirected by some specially configured e largest number of cyberattacks ever re
remote from the VPN owner. Therefore, corded. These attacks are often carried
the user's digital footprint is hidden. The out by attackers to steal personal inform
footprint of the VPN server is taken by ation or commit financial fraud. As you
the receiver. can see, knowledge is the next utility of t
This can put an entire organization or p he future.Cybercriminals often use pseu
erson at risk. The work shows as a donymous IP addresses to hide real IP a
computational model where address the ddresses for greater anonymity. For this
limitations currently encountered in , we plan to create a solution that can de
VPN traffic analysis. The model used by tect whether
to describe virtual private networks IP is real IP or proxy IP or VPN IP.
(VPNs) is built using a -trained
multilayer perceptron neural network
using traffic statistics in the KEYWORDS
Transmission Control Protocol (TCP)
headers of the captured network packets. Residential proxy, cyberattacks,
Cybercriminals, Security, Fraud
 I. INTRODUCTION stion and improve response time, especiall
y for frequent requests. Like Virtual Private
A proxy server is a software program that Networks (VPNs), proxy servers allow
acts as a intermediary between a client's users to hide their true IP address and make
machine and the destination server. When a their internet traffic appear to come from a
client application wants to access a different IP address. This is possible
particular resource, it sends a request because Since the client application sends
through the network to a proxy server. Once the request to the proxy server, the source
the proxy server receives the request, it IP address of the incoming traffic on the end
determines the desired resource and the node will belong to the proxy server., rather
server where it is located, along with any than the user's machine. However, since
additional information that needs to be proxies are often located at data centers,
transmitted. some web services have started blocking
Once the request reaches the proxy server network traffic coming from them in order
and any necessary processing is completed, to prevent annoymous activity. In addition,
the proxy server forwards the request to the data center IP ranges tend to start with the
target server and then waits for a response. same few integers, making them very easy
Once the response is obtained, the proxy to identify and restrict.
server forwards it back to the client. To As a result, some proxy services have
improve performance, a proxy server may started using rotating IP addresses or
implement caching. Caching involves offering access to residential IP addresses
storing a copy of frequently requested to bypass these restrictions. However, it is
resources on the proxy server, so that they important to note that using proxies or
can be served quickly without having to be VPNs to engage in illegal activities is still
fetched from the destination server every against the law and can result in
time they are requested. This can help to consequences such as legal action or
reduce network congestion and improve account suspension.
response times, especially for resources that
are requested frequently. In addition to The use of false IP addresses is a common
caching, proxies can also be used to tactic used by cybercriminals to conceal
implement access control and filtering. their actual IP addresses and remain
anonymous. The main goal of our work is
Access control involves restricting access to identify the real IP address, or if
to certain resources based on user applicable, the VPN IP address, of
credentials or other criteria, while filtering cybercriminals who are hiding behind a
involves blocking access to certain pseudonym. Hackers use various methods
resources based on content or other to hide their online activities, making it
characteristics.One of the advantages of us challenging for law enforcement agencies
ing a nameserver is that it provides caching to track them down and prosecute them.
to improve performance. Caching involves Typically, they avoid directly accessing
storing copies of frequently requested requ their intended target computer and instead
use a proxy server or VPN server as an
ests on the name server so they can be proc
intermediary layer between their device and
essed quickly without having to be retrieve
the target computer. One possible solution
d from the target server each time they are r
to this issue is to input an IP address and
equested. This helps reduce network conge determine whether it belongs to a proxy or
VPN provider. This can be achieved
through the use of IP geolocation databases
and other tools that are designed to identify II. RELATED WORK
the IP addresses of known proxy and VPN A) Research papers
servers. By identifying the IP addresses 1. "Tracking Anonymized Bluetooth
associated with proxy and VPN providers, Devices" by Jonathan Petit and
law enforcement agencies can more David Oswald: This research work
effectively track down cybercriminals and focuses on tracking anonymized
hold them accountable for their actions. Bluetooth devices using passive
However, it is important to note that this sniffing techniques. The authors
approach may not always be effective, as demonstrate how they can track the
cybercriminals may use tactics such as IP movements of Bluetooth devices
address spoofing to further conceal their even when they are not transmitting
identities. As such, it is important for law data.
enforcement agencies to continually
develop and implement new tools and 2. "On the Effectiveness of IP Address
strategies for tracking down and Obfuscation for Anonymous
prosecuting cybercriminals. Communication" by Chen Chen et
IP blocking is a simple technique used to p al.: This study evaluates the
revent network threats and is also one of th effectiveness of different IP address
e most common network protection techni obfuscation techniques in providing
ques . Using this method, you can prevent anonymous communication. The
one IP address or multiple IP addresses fro authors analyze the performance of
m accessing the addresses of your web ser various obfuscation techniques such
ver or your organization's internal network as Tor, VPNs, and proxies.
. Using a proxy or VPN can be used witho
ut IP blocking. The user's IP address is usu 3. "Proxy Detection: A Survey" by
ally sent to the web server as the destinatio Andrei Petrovich et al.: This survey
n IP address in network packets containing provides an overview of different
requests. However, when using a proxy or techniques used for proxy detection.
VPN, this request is first sent to the proxy The authors discuss the advantages
server and then forwarded to the web serve and limitations of various methods,
r. including blacklists, honeypots,
Therefore, the user's blocked IP address ha machine learning, and behavioral
s no direct connection to the web server ru analysis.
nning the IP filter. It has the ability to bloc
k domain names or VPN IP addresses, but 4. In 2021, a research paper titled
it is possible to make the blocking of IP ad "Detection of Anonymizing
dresses permanent. Users can switch to an Proxies" demonstrated the use of
other domain or VPN computational models with
intelligent machine learning
service provider after detecting that their p techniques to overcome the
referred IP address is blocked. Unless prec limitations posed by unauthorized
autions taken (which will costsa lot of ti users. One such model uses a
me and effort), users can make change to c multilayer perceptron neural
ontrol their access network to detect the use of
 anonymous names. This model 7. Research on the security aspects of
leverages the information in web proxy services has been widely
Transmission Control Protocol conducted in the literature. One
(TCP) headers from captured example is the study by Weaver et
network packets to learn and al., who investigated the impact of
analyze data. By utilizing these free proxy services on traffic. Their
techniques, the authors were able to study used controlled clients and
improve the accuracy of detecting servers to exchange known HTTP
anonymizing proxies and enhance messages and detect any anomalies
security measures against potential from the expected behavior..
cyber threats. Similarly, Carnavalet et al.
proposed a framework to evaluate
5. The research paper "Detecting VPN client-end TLS proxies, while
Tunnels Using Deep Packet Perino et al. developed a distributed
Inspection" explores the use of deep measurement platform to monitor
packet inspection (DPI) to identify the free proxy ecosystem. In another
VPN tunnels. The authors discuss study, Tsirantonakis et al. proposed
the effectiveness of DPI in detecting a methodology for detecting proxies
the presence of VPN traffic and that actively modify the relayed
differentiating it from other types of content. However, unlike previous
traffic. They also analyze various research that focused on web
techniques for inspecting VPN proxies.
traffic to identify the location and
identity of the user. By using these
techniques, the authors were able to 8. In a paper entitled "A Method for
improve the accuracy of detecting Original IP Detection," the authors
VPN tunnels and enhance security proposed a technique for detecting
measures against potential cyber the original IP of a client's physical
threats. NIC. The method involves checking
for the presence of a virtual NIC that
6. In the field of web proxy services, is installed by the VPN client in
security has been a popular area of front of the physical NIC. The
research. A study conducted by authors suggest requesting that
Weaver et al. in 2010 examined the customers who connect to the web
functionality of free proxy services server execute a script to check the
and their impact on network traffic. origin IP. If a VPN is being used,
The researchers used controlled the IP of the virtual NIC is sent as
clients and servers to exchange the VPN Entry, and the original NIC
HTTP messages, and then analyzed IP (original IP) is sent to the web
any variations from the expected server. Once the script has been
behavior. The purpose of this study executed, it is restored.
was to investigate the potential
security risks associated with the B) Existing System Architecture
use of free proxy services.
 The Internet's original design didn't intend
to monitor user behavior, operating as an
open platform that allows anonymity.
Unfortunately, some malicious actors
exploit this anonymity, making it hard to
hold them accountable for their actions in
court. In response, a new tool called
Voyager has been proposed, which utilizes
tracking pixels. This tool has the potential
Fig.1
to aid investigators in making more
Honeypots: Honeypots are designed to informed decisions during investigations by
mimic real computers, complete with enabling them to track and monitor the
applications and files, to appear as activities of anonymous users.
attractive targets to cybercriminals. Unlike
firewalls or antivirus software, honeypots
do not specifically address security issues; III. METHODOLOGY
instead, they offer insights into current and
developing threats that can assist in A. PROPOSED SYSTEM
comprehending the risks faced by an
organization. By using the data collected Creating a honeypot security mechanism
from honeypots, organizations can can be an effective way to detect
determine security priorities and direct unauthorized users who connect through a
their efforts towards improving overall VPN server and to identify their actual IP
safety. address. By luring potential attackers into
interacting with a system that appears to be
vulnerable, security professionals can
VPN Discovery: The use of web proxies monitor and analyze their behavior to gain
and virtual private networks (VPNs) has insight into their tactics and identify their
become increasingly popular among both true IP address. By doing so, we can attract
businesses and individual users who seek and lure potential attackers, and when they
to mask their online activities. To attempt to steal our fabricated data, we will
overcome the limitations posed by send a Trojan along with it. Once the Trojan
unauthorized users, computational models successfully infiltrates an attacker's system,
that utilize intelligent machine learning it can potentially transmit information such
techniques have been developed. For as the attacker's IP address, data, logs, and
example, one such model employs a files. By analyzing this information, it may
multilayer perceptron neural network to be possible to determine the location of the
detect the use of anonymous names by attacker. However, it's important to note
analyzing the information contained in the that the use of Trojans to gather information
Transmission Control Protocol (TCP) without the user's consent is illegal and
headers of network packets captured unethical. It's essential to take appropriate
during communication. legal and ethical considerations into
account when considering such actions.
Clickbait Systems: The task of
maintaining relevance, or linking online
activities to their respective actors, is
challenging in cybersecurity and forensics.
 requirements, budget, technical expertise,
and growth plans.
Set up the honeypot website: To set up a
honeypot website for security purposes, it's
important to mimic a legitimate e-
commerce website to attract unauthorized
users. One can use realistic product images,
descriptions, and fake products to make the
website look authentic and professional.

Fig 2 :Proposed system

Implement security measures: To prevent
architecture
real customers from accidentally stumbling
B. IMPLEMENTATION onto the honeypot website, it is
recommended to use a subdomain or a
DETAILS completely different domain name for the
Techniques used in the proposed system honeypot website. Additionally, you can
are: add a warning message or disclaimer on the
honeypot website stating that it is a
Honeypot: The concept of a honeypot simulated environment for security testing
involves creating a system that imitates a purposes only and is not a legitimate e-
genuine computer, with realistic
commerce website. It is also important to
applications and data, to trick
implement access controls and restrict
cybercriminals into believing it is a viable
target. Unlike specific solutions such as access to the honeypot website only to
firewalls or antivirus software, honeypots authorized personnel. This can be achieved
are not designed to address particular through the use of authentication
issues. Instead, they serve as valuable tools mechanisms such as passwords or IP
for gathering information that can aid in restrictions.
recognizing existing and emerging threats
to a business. By analyzing intelligence
gathered from honeypots, organizations can Monitor the honeypot: After setting up the
identify and prioritize security concerns to honeypot, it is crucial to monitor it carefully
improve overall safety. for any indications of an attack. You can
use different tools like intrusion detection
Selecting an appropriate e-commerce
systems, web application firewalls, and log
platform is crucial for the success of an
analysis tools to monitor the traffic and
online business. With so many options
activity on the honeypot. By doing so, you
available, it's important to consider your
can detect any suspicious activity or
specific needs and abilities when choosing
attempted attacks and gather information
a platform. Popular e-commerce platforms
about the attackers, such as their IP
include WooCommerce, Shopify, Magento,
addresses, the methods they use, and the
and many others. Each platform has its
vulnerabilities they exploit. This
strengths and weaknesses, so it's important
information can be used to strengthen the
to do research and evaluate which platform
security of your system and prevent future
best aligns with your business
attacks.
Analyse the data: After setting up the IV. COMPONENTS
honeypot and implementing security
measures, it is crucial to closely monitor the A. WEB INTERFACE
website for any suspicious activity. This The system is composed of two distinct
can be accomplished through the use of web components: a frontend application and a
application firewalls, intrusion detection back-end application.
systems, and log analysis tools. Once the
honeypot has gathered data on attackers, it 1.Front-end:
is essential to analyze this data to identify Node.js is a popular server-side
patterns in their tactics and techniques. This programming language used for web
analysis can provide valuable insights into development, while React is a widely used
the methods used by attackers and help in JavaScript library that allows for the
the development of more effective security creation of user interfaces in web
measures. Ultimately, the goal is to applications. By combining these two
improve the overall security of e-commerce technologies, developers can create
websites and protect against cyber threats. dynamic, scalable, and efficient web
applications with a responsive user
interface. React is particularly useful for
It's important to keep in mind that VPN front-end development because it enables
providers can take measures to make it the creation of modular components that
difficult to identify the IP address behind a can manage their own state, resulting in the
VPN. One way they can do this is by using development of interactive features and
advanced encryption and tunneling functions that enhance the user experience.
protocols to protect the privacy of their
users. Additionally, VPN providers may 2. Back-end:
route traffic across multiple servers and use To handle the data storage and retrieval, the
methods like packet fragmentation to application uses a MySQL database as its
obscure traffic patterns and make it harder back-end. The database is accessed through
to track their users' activities. As such, a simple API that is designed to accept
identifying the actual IP address of a user requests from the user interface and
behind a VPN can be challenging, and it perform tasks such as creating, modifying
may require more advanced techniques and or storing data in response to these requests.
tools. By using a database management system
Trojan: The term Trojan generally refers to like MySQL, the application can efficiently
malicious software that is designed to store and retrieve data while ensuring the
deceive users about its true intentions. security and integrity of the information.
Typically, a Trojan disguises itself as a This allows for seamless communication
legitimate file or application in order to between the front-end and back-end of the
trick the user into downloading and application, resulting in a more robust and
installing it. The ultimate goal of a Trojan reliable software system.
is to execute its malicious functions, which
may include stealing sensitive data,
modifying or deleting files, or taking B: Capturing and Analyzing
control of the infected device. Network Traffic
The system monitors network traffic for Machine Learning” S. International Journal
any suspicious activities and records the IP of Digital Crime and ForensicsVolume 13 •
addresses of users, along with information Issue 6, 2021
about whether they are using a proxy and
3. Samuel Decanioa, Michael Soltysa,
their geographical location. This data is fed
Kimo Hildreth “Voyager: Tracking with a
into a Random Forest Model, an ML
Click” KES International.
algorithm that checks for any signs of
10.1016/j.procs.2020.08.11
malicious activity. If a user manages to gain
unauthorized access to the admin section, 4. Ankith Rai, Jovita Dsouza,
they will be met with malware disguised as Edison.C.Saldanha. “Secure +, An
important data. The Trojan that comes with Intrusion Detection System” International
the fake data will also transmit the real IP Journal of Innovative Science and Research
address of the attacker to the system admin. Technology Volume 4, Issue 5, May– 2019
5. V. Rawat, R. Tio, S. Nanji and R.
Verma, "Layer Two Tunneling Protocol
(L2TP) over Frame Relay," February 2001,
pp. 1-3. [Online].
Available:

V. CONCLUSION https://www.researchgate.net/publication/2
77825842_Layer_Two_Tunneling_Protoc
The study showcases a proxy detection ol_L2 P_over_Frame_Relay.
mechanism that can identify VPN proxies
6. Z. Hou, M. Xu, L. Zhu, L. Peng and B.
used by attackers and provide the actual IP
Hu, "The Design and Realization of the
address of the user behind it. A honeypot
Test Scheme OpenVPN, Based on
website is set up to attract malicious users,
Message Simulation," November 2013.
and a Trojan is planted in a file that
[Online]. Available:
appears to contain important data. Once
the attacker downloads and executes the https://www.researchgate.net/publication/2
Trojan, it will report the attacker's IP 66643218_The_Design_and_
address to the administrator, alerting them Realization_of_the_Test_Scheme_OpenV
of the attack. PN_Based_on_Message_Simu lation.

REFERENCES 7. Miller, S., Curran, K. and Lunney, T.

(2018) 'Detection of Anonymising Proxies
using Machine Learning', Special issue on
Machine Learning for Cyber Security in
1. Vipasha Chaudhary, Dr. Purushottam Journal of Information Science (MDPI),
Sharma, Dr Vinod Kr Shukla, Vikasdeep. ISSN 2078-2489, (Accepted) 2019
“Tracking and Tracing proxy enabled
8. Geetha, S. and Phamila, A. V. (2016)
system” (ICRITO) Amity University,
Combating Security Breaches and Criminal
Noida, India. Sep 3-4, 2021
Activity in the Digital Sphere. First. IGI
2. hane Miller, Kevin Curran,Tom Lunney Global. doi: 10.4018/978-1-5225-0193-0.
“Detection of Anonymising Proxies Using
9. Wood, D.. (1988) ‘Virtual private
networks’, in 1988 International
Conference on Private Switching Systems
and Networks, New York, USA, pp. 132–
136.
10. Zorn, G. (1999) ‘Point-to-Point
Tunneling Protocol (PPTP)’, RFC 2637,
pp. 1–57. Available at:
https://tools.ietf.org/html/rfc2637
(Accessed: 12 January 2018).