A walkthrough of how anonymizer unmasking actually works
The chain of signals blackpot.io correlates to detect a session coming through a commercial VPN, Apple Private Relay, or a residential proxy — and why any single signal on its own is insufficient.
Adversaries who care about attribution avoidance layer their tooling. A typical target-of-interest scan chain looks something like: cheap VPS → commercial VPN → residential proxy → target. Every hop launders one specific signal — source IP, TLS fingerprint, ASN reputation — and none of them, on its own, is a reliable defender signal.
blackpot.io's approach is to require agreement across independent layers. A session is only flagged as anonymized when two or more of the following converge:
1. TCP-stack OS vs. declared User-Agent OS mismatch
The kernel's TCP window size, TTL, and MSS on the SYN packet are set by the OS network stack. macOS defaults are visibly different from Windows defaults which are visibly different from Linux defaults. A residential proxy exit node running Linux will produce a Linux-shaped SYN — but if the attacker's real browser is Chrome on macOS, the User-Agent will claim Darwin. Mismatch is a strong residential-proxy signal.
2. Browser-declared timezone vs. GeoIP country
The injected JS beacon harvests Intl.DateTimeFormat().resolvedOptions().timeZone. If the beacon reports America/Los_Angeles but the GeoIP places the source IP in Frankfurt, the drift is 9 hours. Occasional traveler false positives exist; systematic 8+ hour drift across many sessions is not a traveler.
3. WebRTC LAN leak
When a visitor's browser runs our page, WebRTC's ICE candidate gathering can reveal the browser's local LAN address — the 192.168.x.x or 10.x.x.x behind the proxy — and, on some VPN setups, the real public address. Modern browsers increasingly mask these candidates, and scripted scanners never run JavaScript at all, so this signal is opportunistic: strong when it fires, silent most of the time.
4. Hosting-ASN heuristic
Consumer-shaped User-Agent (Chrome, Safari, Firefox on macOS/Windows) coming from a source ASN registered to DigitalOcean, Vultr, Linode, or a known VPN provider is anomalous. Consumers browse from residential ISPs. This heuristic alone misfires on some VPS-based enterprise workflows; combined with any of the above, it firms up considerably.
5. Apple Private Relay CIDRs
Apple publishes the egress CIDR list for iCloud Private Relay. A session sourced from those ranges is almost certainly coming through Private Relay. The interesting question is not "is this Private Relay" but "given Private Relay, what does the app-layer behaviour tell us about intent" — which is where session interaction depth and canary trips carry weight.
Why the union matters
Any single one of these can misfire. A traveling Mac user on a European hotel Wi-Fi trips the timezone check. A corporate BYOD user tunneling through a Cloudflare Access proxy trips the hosting-ASN heuristic. Requiring two independent layers to agree pushes false-positive rate below the threshold at which enforcement decisions become defensible.
The dossier for any given session shows exactly which layers agreed and what each contributed. Operators are looking for the pattern "two signals said VPN, three signals said residential proxy, none said clean consumer" — that is the state at which we flag ANONYMIZED · high confidence and recommend an enforcement action.
The daemon's anonymizer engine lives in pkg/anonymizer and is intentionally readable — a security engineer can audit the entire scoring in a single sitting. When we add new signals, they land as separate, testable functions with their own confidence weights, so operators can trust the derivation over time.