The IP looks legitimate. The activity isn't.
Residential proxies, compromised routers, and anonymization networks allow attackers to route malicious activity through infrastructure that looks like ordinary internet traffic. That makes it harder for defenders to recognize account takeovers, financial fraud, espionage, and other threats.
Join Dave Shackleford, SANS instructor and founder of Voodoo Security, as he examines real-world attacks and investigations where anonymization helped conceal the adversary. Dave will reconstruct how attackers used these networks, explain why familiar IP-based signals can miss the threat, and explore what defenders can use to recognize suspicious activity earlier.
What you'll learn
- ■ How attackers hide their origins. Examine how residential proxies, compromised devices, and anonymization services disguise malicious activity.
- ■ Why conventional detection can miss the threat. Understand the limitations of IP reputation, geolocation, and traditional monitoring when attackers blend into normal traffic.
- ■ What can expose suspicious activity. Explore behavioral indicators, network telemetry, and infrastructure intelligence that help reveal activity behind legitimate-looking IPs.
- ■ How to strengthen investigations and detection. Learn practical approaches to applying these signals in threat hunting, identity security, fraud detection, and account takeover investigations.