{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T18:44:24Z","timestamp":1783536264649,"version":"3.55.0"},"reference-count":21,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2025,2,9]],"date-time":"2025-02-09T00:00:00Z","timestamp":1739059200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>The growing use of VPNs, proxy servers, and Tor browsers has significantly enhanced online privacy and anonymity. However, these technologies are also exploited by cybercriminals to obscure their identities, posing serious cybersecurity threats. Existing detection methods face challenges in accurately tracing the real IP addresses hidden behind these anonymization tools. This study presents a novel approach to unmasking true identities by leveraging honeypots and Canarytokens to track concealed connections. By embedding deceptive tracking mechanisms within decoy systems, we successfully capture the real IP addresses of users attempting to evade detection. Our methodology was rigorously tested across various network environments and payload types, ensuring effectiveness in real-world scenarios. The findings demonstrate the practicality and scalability of using Canarytokens for IP unmasking, providing a non-intrusive, legally compliant solution to combat online anonymity misuse. This research contributes to strengthening cyber threat intelligence, offering actionable insights for law enforcement, cybersecurity professionals, and digital forensics. Future work will focus on enhancing detection accuracy and addressing the advanced evasion tactics used by sophisticated attackers.<\/jats:p>","DOI":"10.3390\/info16020126","type":"journal-article","created":{"date-parts":[[2025,2,10]],"date-time":"2025-02-10T03:39:47Z","timestamp":1739158787000},"page":"126","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":5,"title":["Unmasking the True Identity: Unveiling the Secrets of Virtual Private Networks and Proxies"],"prefix":"10.3390","volume":"16","author":[{"given":"Vikas Kumar","family":"Jain","sequence":"first","affiliation":[{"name":"School of Technology Management and Engineering, SVKM\u2019S NMIMS, Indore 452005, India"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jatin","family":"Aggrawal","sequence":"additional","affiliation":[{"name":"School of Computing Science Engineering and Artificial Intelligence, VIT Bhopal University, Sehore 466114, India"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ramraj","family":"Dangi","sequence":"additional","affiliation":[{"name":"School of Computing Science and Engineering, VIT Bhopal University, Sehore 466114, India"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3501-0500","authenticated-orcid":false,"given":"Shiv Shankar","family":"Prasad Shukla","sequence":"additional","affiliation":[{"name":"School of Computing Science Engineering and Artificial Intelligence, VIT Bhopal University, Sehore 466114, India"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4027-8229","authenticated-orcid":false,"given":"Anil Kumar","family":"Yadav","sequence":"additional","affiliation":[{"name":"School of Computing Science Engineering and Artificial Intelligence, VIT Bhopal University, Sehore 466114, India"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3378-2945","authenticated-orcid":false,"given":"Gaurav","family":"Choudhary","sequence":"additional","affiliation":[{"name":"DTU Compute, Department of Applied Mathematics and Computer Science, Technical University of Denmark (DTU), 2800 Kongens Lyngby, Denmark"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2025,2,9]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Babu, K.G., Naveen, J., Vamsi Dhar Reddy, P.V., Imam, A., and Vetri Selvi, V.S. (2023, January 5\u20136). Tracing phishing website original IP address. Proceedings of the 2023 International Conference on Networking and Communications (ICNWC), Chennai, India.","DOI":"10.1109\/ICNWC57852.2023.10127555"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Nithesh Aravind, T., Mukundh, A., and Vijayakumar, R. (2023, January 5\u20136). Tracing IP Addresses Behind Vpn\/Proxy Servers. Proceedings of the 2023 International Conference on Networking and Communications (ICNWC), Chennai, India.","DOI":"10.1109\/ICNWC57852.2023.10127335"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Fan, X., Gou, G., Kang, C., Shi, J., and Xiong, G. (2019, January 29\u201331). Identify OS from encrypted traffic with TCP\/IP stack fingerprinting. Proceedings of the 2019 IEEE 38th International Performance Computing and Communications Conference (IPCCC), London, UK.","DOI":"10.1109\/IPCCC47392.2019.8958772"},{"key":"ref_4","first-page":"7924690","article-title":"VPN traffic detection in SSL-Protected Channel","volume":"2019","author":"Saleem","year":"2019","journal-title":"Secur. Commun. Netw."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Goel, A., Kashyap, A., Reddy, B.D., Kaushik, R., Nagasundari, S., and Honnavali, P.B. (2022, January 11\u201313). Detection of VPN network traffic. Proceedings of the 2022 IEEE Delhi Section Conference (DELCON), New Delhi, India.","DOI":"10.1109\/DELCON54057.2022.9753621"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Cuzzocrea, A., Martinelli, F., Mercaldo, F., and Vercelli, G. (2017, January 11\u201314). Tor traffic analysis and detection via Machine Learning Techniques. Proceedings of the 2017 IEEE International Conference on Big Data (Big Data), Boston, MA, USA.","DOI":"10.1109\/BigData.2017.8258487"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Liu, Y., and Shue, C.A. (2020, January 16\u201319). Beyond the VPN: Practical Client Identity in an Internet with Widespread IP Address Sharing. Proceedings of the 2020 IEEE 45th Conference on Local Computer Networks (LCN), Sydney, NSW, Australia.","DOI":"10.1109\/LCN48667.2020.9314846"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Singh, K.K., and Gupta, H. (2016, January 4\u20135). A new approach for the security of VPN. Proceedings of the Second International Conference on Information and Communication Technology for Competitive Strategies, Udaipur, India.","DOI":"10.1145\/2905055.2905219"},{"key":"ref_9","unstructured":"(2024, February 08). VPNs and Private Browsing: Best Practices in Securing the Unknown. Available online: https:\/\/datos-insights.com\/reports\/vpns-and-private-browsing-best-practices-securing-unknown\/."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"471","DOI":"10.1109\/TIFS.2014.2381873","article-title":"Passive IP traceback: Disclosing the locations of IP spoofers from path backscatter","volume":"10","author":"Yao","year":"2015","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Pannu, M., Goel, A., and Kaur, M. (2016, January 12\u201314). Exploring Proxy Detection Methodology. Proceedings of the 2016 IEEE International Conference on Cybercrime and Computer Forensic (ICCCF), Vancouver, BC, Canada.","DOI":"10.1109\/ICCCF.2016.7740438"},{"key":"ref_12","unstructured":"Khatri, A., Zaveri, K., Patel, D., and Shah, M. (2016). Dynamic Address Allocation Algorithm for Mobile Ad Hoc Networks. arXiv."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"60","DOI":"10.4018\/IJWNBT.2020070104","article-title":"Detection of virtual private network traffic using machine learning","volume":"9","author":"Miller","year":"2020","journal-title":"Int. J. Wirel. Netw. Broadband Technol."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Chaudhary, V., Sharma, P., and Shukla, V.K. (2021, January 3\u20134). Tracking and Tracing Proxy Enabled Systems. Proceedings of the 2021 9th International Conference on Reliability, Infocom Technologies and Optimization (Trends and Future Directions) (ICRITO), Noida, India.","DOI":"10.1109\/ICRITO51393.2021.9596078"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"4099","DOI":"10.22214\/ijraset.2023.52592","article-title":"IP detection using different approaches using VPN\/Proxy","volume":"11","author":"Gaikwad","year":"2023","journal-title":"Int. J. Res. Appl. Sci. Eng. Technol."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Kalangi, R.R., Sundar, P.S., Maloji, S., and Ahammad, S.H. (2021, January 11\u201313). A hybrid IP trace back mechanism to pinpoint the attacker. Proceedings of the 2021 Fifth International Conference on I-SMAC (IoT in Social, Mobile, Analytics and Cloud) (I-SMAC), Palladam, India.","DOI":"10.1109\/I-SMAC52330.2021.9640630"},{"key":"ref_17","unstructured":"(2024, February 24). IP Spoofing: What Is It and How Does It Work?. Available online: https:\/\/hk-en.norton.com\/."},{"key":"ref_18","unstructured":"(2023, December 20). What Is a Cyber Attack: Types, Examples, Prevention. Available online: https:\/\/www.imperva.com\/learn\/application-security\/cyber-attack\/."},{"key":"ref_19","unstructured":"(2024, January 25). What Is the Function of Honeypots in Cybersecurity?\u20145 Answers from Research Papers. Available online: https:\/\/typeset.io\/questions\/what-is-the-function-of-honeypots-in-cybersecurity-42girmbz0l."},{"key":"ref_20","unstructured":"Canarytokens (2024, January 29). Canarytokens\u2014A Free Tool for Generating Canarytokens. Available online: https:\/\/canarytokens.org\/nest\/."},{"key":"ref_21","unstructured":"(2024, January 25). What Are Canarytokens? How Do Canarytokens Work? Why Does This Matter?\u2014Thinkst Canary. Available online: https:\/\/help.canary.tools\/hc\/en-gb\/articles\/4701687447325-What-are-Canarytokens#:~:text=Canarytokens%20are%20a%20simple%20way,the%20benefit%20from%20them%20immediately."}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/16\/2\/126\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T16:29:56Z","timestamp":1760027396000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/16\/2\/126"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,2,9]]},"references-count":21,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2025,2]]}},"alternative-id":["info16020126"],"URL":"https:\/\/doi.org\/10.3390\/info16020126","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,2,9]]}}}