Dodgy Dave uses a VPN for a fake marketplace advert¶

IP Addresses & Networks Offender Viewpoint

Dave advertises a camera he does not own, routes his marketplace activity through a VPN and assumes the recorded IP address can no longer lead anywhere useful. This offender-viewpoint scenario follows what the VPN changes - and the account, advert, communications, payment and device evidence it leaves untouched.

The working principle

A VPN changes the public IP address seen by the marketplace. It does not automatically separate Dave from the account, communications, payment route, device or later use of the money.

VPN connection

Marketplace account

Fake advert

Buyer messages

Payment

Device or account

Dave

Dave changes the address visible at one observation point. The offence still requires him to use several real systems.

Scenario note: This is a fictional training case viewed from the offender's side. It is separate from the domestic-broadband investigation in IP-001. Names, organisations, accounts and records are invented.

Dave's plan¶

The offending plan

False offerA high-value camera Dave does not own

ConcealmentUse a VPN for marketplace activity

ObjectivePersuade a buyer to transfer money

Dave creates a marketplace account, uploads photographs copied from a genuine listing and writes an attractive description. He supplies contact and recovery details so that he can access the account and communicate with buyers.

From Dave's perspective, these are disposable ingredients. From the marketplace's perspective, they may become related events: account creation, sign-ins, changes, image uploads, messages, recovery activity and sessions.

Marketplace account and advert

Accountcamera_clearance_26

AdvertProfessional camera kit - £1,850

ImagesCopied from a genuine advert

Recovery routeEmail address and mobile number supplied

The details may be false, borrowed or shared. They remain account attributes and lines of enquiry to test.

Dave switches on a VPN¶

Dave connects to a VPN before signing in. His traffic travels from his ordinary internet connection to the VPN service and then onwards to the marketplace.

The marketplace normally sees the VPN exit address rather than the public address presented by Dave's home or mobile connection. An ordinary IP lookup may therefore lead first to a VPN or hosting provider.

What Dave thinks happenedVPN address → anonymous accountThe address seen by the marketplace is the only identity attached to the activity.

What actually needs examiningconnection → VPN → marketplaceDifferent systems may record different parts of the route, account and session.

See the two different views of Dave's connection

Dave's version

The route Dave thinks the investigator sees

Dave → VPN address → anonymous marketplace account

Assumption the exit address is the whole identity

The evidence route

Systems involved in the connection

Dave's connection → VPN service → marketplace account · sessions · advert · messages

Marketplace sees the VPN sideVPN service may see another partOther systems record the offending activity

Whether useful VPN records exist, are retained and can be obtained must be established. It should never be assumed - but neither should Dave's anonymity.

What the VPN changesThe public source address recorded by the marketplace.

What remainsThe marketplace account, advert, images, messages, payment route and later activity.

Dave speaks to the buyer¶

A buyer responds. Dave sends messages designed to create confidence and urgency, then directs the buyer towards a payment method he controls.

AccountDave signs in, changes details and manages the advert.

AdvertCopied images and description are uploaded to the marketplace.

MessagesThe conversation creates content, timestamps and identifiers.

Payment directionDave tells the buyer where and how to send the money.

If Dave moves the conversation to email, telephone or another service, he creates another potential evidence source rather than erasing the first one. Changing the visible IP address does not change the words he sends or the operational steps required to receive payment.

Dave receives the money¶

The buyer transfers the money. The payment organisation records its own event from its own observation point. Its records may identify an account, transaction, destination, time and subsequent movement of funds.

AdvertCamera kit
£1,850

Marketplace accountcamera_clearance_26

PaymentBuyer transfer

Next activityAccess or movement of funds

Those records are not made more or less reliable because the marketplace saw a VPN address. They answer a different question about the same alleged offence.

Dave still needs to access or move the money. Each further action can create an event capable of comparison with the marketplace, communications and device evidence.

Dave uses the account again¶

Dave returns to read messages and check whether the buyer has complained. On another occasion he forgets to connect the VPN, uses a different exit or accesses a related account from another device.

This does not prove every session belongs to Dave. It explains why the investigation should compare the complete sequence rather than treating one IP address as the entire case.

Account identifiers, recovery details, message patterns, image reuse, payment routes, device information and timing may connect - or distinguish - activity. Each proposed link must be evidenced and alternative explanations tested.

Dave is pleased with himself¶

The marketplace's fraud report contains an IP address belonging to a VPN provider. Dave assumes the enquiry ends there.

It may not. The address still explains what the marketplace saw and may frame an enquiry to the intermediary. More importantly, the account, advert, images, communications, payment and later device evidence remain separate but potentially connected lines of enquiry.

If a relevant device is recovered, it may contain account, browser, image, message or payment material. Whether an artefact exists and what it proves must be established through examination and the wider evidence.

What Dave changed - and what he did not¶

IP addressThe marketplace sees the VPN exit rather than Dave's ordinary connection.

AccountCreation, recovery and session activity can still be recorded.

AdvertImages, wording, uploads and related listings remain available to compare.

PaymentThe receiving account and movement of money create their own records.

Still to testWho controlled the accounts, devices and money - and who was responsible.

The evidence may be incomplete. Services retain different material; addresses and devices may be shared; accounts may be compromised; and similar behaviour does not prove a common user. The lesson is not that every VPN can be traced through. It is that changing the address seen by one service is not the same as removing every other record required to commit and benefit from the offence.

Operational takeaway

Dave changed the IP address visible to the marketplace. He did not eliminate the account, advert, communications, payment or device evidence created by his fraud.

Investigator walkthroughFollow an IP address from record to developing suspect →Technical foundationUnderstand what an IP address is →

Explore the technical questions behind Dave's method