☘️ { 𝔖𝔠𝔞𝔯𝔩𝔢𝔱𝔱𝔞'𝔰 𝔏𝔬𝔲𝔫𝔤𝔢 } ☘️

🌟 Screen resolution 🟠Screen resolution, window size, scaling. Uniqueness parameters simultaneously involved in risk assessment. Unusual indicators can make a user stand out, especially if the User-Agent shows unnatural signs from using antidetect tools or emulators. For example, a phone displaying computer-like behavior can raise suspicions.

🌟 Passive OS Fingerprint 🟠The fingerprint is formed from operating system-specific parameters of data transfer to the network: size, packet lifetime, and others. A mismatch in the fingerprints of the IP address transmitting traffic and the User-Agent (for example, the packet was sent by Linux, but the client is Windows; or, in other words, an Internet connection via SOCKS on Linux, while at the same time using Windows is a flaw in the user’s portrait. 🟠Since the configuration happens on the server side, the simplest way to improve authenticity is by changing the IP access. You can use standard tools like sharing WiFi from the required device through an emulator or proxy. However, if the anti-fraud system is robust, this step is less critical in the bigger picture.

🌟 User-Agent 🟠Along with the IP address, the first information that a site receives about a user when visiting is the name and version of the browser, device type, operating system and language. To achieve a natural flow, make sure your language matches the characteristics of the chosen disguise. For example, if the IP address is from an English-speaking region, use proper English. 🟠One of the standards of analytical processes is the statistical coincidence of illegal acts with a specific operating system or browser. It can be illustrated this way: for example, obviously suspicious proxy 🟠servers mostly operate on Linux, which affects the attitude towards the operating system itself. 🟠The more legitimate traffic you generate from a widely used operating system or browser, the more natural and balanced your activity will appear, making your disguise harder to detect. A striking example is the Windows, macOS, IOS, and Android lines.

🟠So, chronic use of a single configuration in work will inevitably lead to client recognition, which can cause refusals to carry out transactions along with suspicious fingerprints. Very often, a data collection and analysis scenario includes:

First part of the lecture completed ✅ Digital fingerprints will be continued tomorrow. 📢Stay Tuned.📢

🌐 Digital Fingerprints 🌐 🟠Fingerprint is a unique snapshot of browser and operating system settings. The receiving mechanism is actively used by anti-fraud systems both for assessing the risks of transactions and for simple surveillance, because it allows you to recognize the client despite changing the IP address, clearing cookies, and with a strong system, some settings. 🟠From a security point of view, it represents a set of methods by which a user is identified against others. This is also why the principle of isolation of the working environment is declared: it is one thing to assign a unique identifier to an anonymous observer for the purposes of advertising tracking and statistics collection, but it is completely different to a “buyer”.

➡️Essentially this means: ❕purchases from one IP address using different payment methods are possible ❕IP addresses branded as "proxy" can be effective and ❕there is a whole car for risk assessment and small cart of different rules. 🟠The method for calculating the likelihood of using a proxy is called "proxyScore". "riskScore" - as the name suggests, a risk assessment when analyzing a transaction in general or an IP address in particular. 🟠They are designated within the range of 0-100, respectively, the higher the value, the worse. Mostly, verification services are integrated into material stores, and private representatives can be found on the forum and online. Example : https://scamalytics.com/ 🟠It should be noted that there is inherent variability in evaluation criteria. Every day, blacklists, ISP and other attributes change, and also directly depend on specific anti-fraud systems, dozens of which, in general, should not have an identical device and algorithms. For these reasons, it is extremely important to keep personal statistics.

➡️ Most properties of an IP address are not inherently "bad" or "good". 🟠Proxies, VPNs, servers and specific ISPs may be associated with a corporation, university, cellular operator or other types of legitimate use of the tool, be it a personal purchase at work or transactions from a legal entity. faces. 🟠At the same time, the traffic of groups of people can also be transmitted through one Internet access point, for example, to apply a firewall or improve performance. It follows that a radical policy of containing all suspicious elements will unwittingly cause suffering to ordinary users.

🌟Open Ports 🟠Open ports: 80, 81, 1080, 8123, 8080, 8081 and so on. They indicate the use of proxy means, while at the same time being a double-edged sword. 🟠Firstly, a significant number of these addresses are just the router’s web admin. 🟠Secondly, contrary to the claims of anonymity verification sites, a lot of pure traffic is generated from the above types of IP addresses.

🌟Two-way ping 🟠The approximate time of the client-server route. When characteristic indicators are established (mainly over 40ms), the IP address is classified as a tunnel, which, through the prism of anti-fraud systems, can be one of the indicators of a potentially fraudulent operation. 🟠Unfortunately, without having IP access at the administrator level, this cannot be resolved locally, which leaves the following options: ❕replacement of IP-access (SOCKS/SSH) ❕changing the link leading up to it in the connection chain, for example, changing the VPN server - as an option, this does not always help ❕if you have administrative rights, you must prohibit ICMP traffic; instructions for the IP access system can be found on the network.

🌟DNS or Domain Name System 🟠DNS or Domain Name System is a connecting element between the name of a site and the IP address on which this site is located. A kind of makeweight does not have to match the IP address; personal DNS should not leak. It's usually not a deciding factor, but matching DNS countries and IP addresses is definitely a plus. If its may not be available on SOCKS or SSH, then you can: 🟠Register in the network adapter in the network and sharing control center of the system 🟠Register in the settings of the router (router) 🟠Supplied with a VPN as one of the links in the connection chain.

🌟ISP and Hostname or Internet provider and host name. 🟠Thanks to flashy headlines in names such as "proxy", "hidden", "vpn", intentions to hide and disguise traffic can be established - one of the calling cards of a typical scammer. 🟠Additionally, there are services that offer virtual servers for remote access, either for corporate or private use. Similar to the previous point, the IP address associated with these providers and specific servers can reveal information that doesn’t match the typical pattern of an average user, potentially compromising privacy or anonymity. 🟠In simple words: Using a virtual server like Amazon Remote Desktop is not ideal for privacy. Similarly, using a VPN service, proxy (SOCKS), or SSH tunneling to hide your traffic is considered risky and unreliable. 🟠In addition, there are providers who are at high risk from the point of view of many anti-fraud systems, which are often treated with increased attention. Examples: Paypal, myfairpoint, frontier. And on the contrary, there are several good ones: qwest, charter, cox, att, verizon, comcast. In light of what has been described, even the complete absence of blacklists does not guarantee results.

🌐IP address 🌐 🌟Black lists 🟠Such databases are formed by various companies that track IP addresses that carry out DDoS attacks, spam and other dark activities. Of Course, people who making phishing pages are also using them to block unwanted traffic. 🟠Then Internet providers, postal services, payment systems, banks and stores use them to verify visitors. Consequently, an attempt to place an order from a dirty IP address will usually end in failure: TOR, public VPNs and proxy services are literally littered with blacklists. 🟠In addition, sometimes entire subnets of certain ISPs become victims of bias based on a range of addresses that have previously been involved in fraudulent activity.

😈 The range of parameters originates in anti-fraud systems 😈 🟠Antifraud is a system designed to evaluate financial transactions on the Internet for fraud. In fact, it is the center of rules, filters and lists. Knowledge of the internal kitchen in the future will be of help in overcoming the "barrier" of anti-fraud systems. 🟠From the many rules included in the system, two categories can be distinguished: ❕IP address ❕Digital Fingerprints. 🟠It is necessary to study their content in order to have an idea about the mechanism of substitution of visibility - camouflage and the perspective from which the future “buyer” will be assessed.

➡️ A convenient text editor for record keeping. 🟠Here you have freedom of choice, but if you put the question bluntly, you can give several examples: Notepad++, Sublime Text, VS Code, Atom. At the same time, as with passwords and backup copies, it is certainly not worth keeping information in cloud storage. 🟠The final sequence of connections in the minimum acceptable configuration will be as follows: Main system > VPN > encrypted data storage area > virtual system > SOCKS / SSH > Internet. 🟠The chain is variable and can be supplemented in every possible way by introducing new links. For example, the last two points can be replaced with remote desktops: ...virtual system > VNC / RDP / dedicated server > Internet. It is possible to supplement with an anti-detect, building a series of VPNs - in total, maneuvering is limited only by the imagination.

🟠Antidetect is a program that uniquely works on the Internet, replacing browser fingerprints - for example, Linken Sphere. If available, a virtual machine is not necessary, although from a security perspective it is worth keeping the tools in an isolated area. Use as desired, there will be a lecture on this topic in the future.

➡️ In order to disguise the IP address as work (in particular, as the owner of the material), SOCKS proxies and SSH tunnels are used. 🟠They are presented in the format ip-port + login-password (moreover, the login-password is not always). These network protocols use different connection methods, to initiate which you should install a set of Proxifier for socks and Bitvise or PuTTY for tunnels, respectively. 🟠In Proxifier, the "Resolve hostnames through proxy" checkbox is enabled in the "Name Resolutions" item; the hosts are added directly in the "Proxy Servers" tab. 🟠When using Proxifier in conjunction with Bitvise or PuTTY for SSH, a rule is added to "Rules" on the shortcut of the desired client, where the first or second item is selected in Action; socks should be like 127.0.0.1:8081/8080 without a password. 🟠Other configuration comes down to filling out the input fields in clients with information about IP access - IP, ports, logins and passwords. There are plenty of guides on the network and on the forum about the above-mentioned clients, so we won’t go into more detail. Profixier Guide (with Keys): https://t.me/c/1154385673/4801

➡️ A set of common browsers. 🟠Firefox 🟠Chrome 🟠Safari 🟠TOR Browser 🟠and others. 🟠Regarding the latter, forums and material stores often have mirrors in the .onion zone, which must be opened through the tors. To prevent leakage of the real IP address, WebRTC technology is disabled in browsers: https://whoer.net/blog/how-to-disable-webrtc-in-various-browsers/

➡️ VPN. 🟠An encrypted connection from the user to the server through which the network is accessed. To avoid conflicts with other IP accesses, it is installed on the main system. It is optimal to choose a service from third world countries; the post-Soviet space is out of the question; a commercial service should not log. 🟠You can create a VPN yourself by internally setting up a server dedicated for this purpose. After connecting, the IP address must change. 🟠The function of blocking traffic in case of unintentional disconnection of IP access in order to protect against disclosure of the real IP address in VPN clients is called KillSwitch and is contained in many clients, and in the Windows firewall it is implemented thanks to creating rules in "Firewall Properties": Outbound connections > Block of three tabs, then Outbound Rules > Program > application to connect to the network > Allow the connection. There are also special programs on the network.

👨‍💻The working arsenal for our jobs includes the following: