Video summary

How The FBI Finds Your REAL IP Address

Main summary

Key takeaways

Summary of the Video

The video explains that the FBI can sometimes identify a person’s “real” IP address and/or link anonymous activity back to them even when they use privacy tools like VPNs and Tor. The speaker presents six methods, but in the provided subtitles only methods 1–5 are detailed; method 6 is not shown.

Key Ideas by Method

  1. VPNs keep logs (even “no-logs” VPNs)

    • Many VPN providers still store connection logs, such as:
      • when you connected,
      • the source IP you connected from,
      • how long you stayed,
      • how much data you transferred.
    • When subpoenaed, investigators can use these logs to connect a person to activity without needing your full browsing history.
    • The video includes examples of VPN providers handing over data in real cases.
    • Defense / mitigation suggested:
      • Choose VPNs with independent audits
      • Prefer transparency reports
      • Use stronger legal shielding (e.g., providers outside the US)
      • Ideally use VPNs that have been tested in court (named: Mullvad, IVPN, ProtonVPN)

  2. Browser exploits / NITs (code runs on your device)

    • Instead of watching network traffic, the FBI can use Network Investigative Techniques (NITs) via compromised or FBI-run websites.
    • When the page runs, it can extract your real IP address and other device identifiers directly from your computer/OS.
    • A major example described is “Playpen”, where many Tor users were deanonymized due to an outdated Firefox/Tor browser vulnerability.
    • Defense / mitigation suggested:
      • Update your browser and operating system immediately
      • Enable automatic updates

  3. Traffic correlation on Tor (watching both ends)

    • Tor’s encryption is not the main weakness; the concern is metadata, specifically:
      • timing,
      • traffic volume,
      • patterns entering and leaving Tor.
    • If the entry and exit patterns match closely enough, users can be linked.
    • Defense / mitigation suggested:
      • Avoid time-sensitive activity on Tor
      • Don’t use Tor on a network where you’re the only/unique user at that time
      • Recognize that perfect anonymity isn’t realistic against a determined nation-state

  4. Browser fingerprinting even through Tor

    • Even if IPs are hidden, the browser can reveal a unique “fingerprint” (e.g., version, OS, screen size, fonts).
    • If the fingerprint remains consistent across visits, it can link identities and activity across VPN/Tor and real accounts.
    • Defense / mitigation suggested:
      • When using Tor: use the Tor Browser as-is (no modifications like extensions/settings/window changes)
      • For normal browsing: use Firefox/Brave with built-in fingerprint resistance enabled

  5. Operational security mistake: identity reuse

    • The biggest real-world exposure often isn’t technical—it’s human behavior.
    • Reusing the same username/email/handle/password (or even slight variations) across accounts creates a trail investigators can follow using OSINT and public/breached data.
    • The video cites historical cases to illustrate this pattern (e.g., Silk Road, Stratfor hacking, and a Harvard incident).
    • Core lesson: tools can mask traffic, but reusing identifiers links you.

Speakers

  • The video narrator/speaker (the person talking through the whole explanation; name not provided in the subtitles)

Original video