Digital Element - Digital Element

The Tricky Science Behind IP Geolocation

Posted on September 6, 2023February 21, 2025 by Digital Element

IP geolocation is a subject that is often misunderstood. Generally people understand that it is about mapping of IP addresses of internet-connected devices to their geographic location, but the nuances behind accuracy, coverage, and granularity can be a bit, well…confusing.

In this post, we’ll break down some of the intricacies of IP geolocation and share some facts and examples that will clear up some of the confusion, and demonstrate how corporate security and marketing teams can receive unmatched data refined by experience and an unending commitment to data quality.

The Importance of Bi-directional Accuracy

Let’s start by saying you’re a marketer and you want to target Atlanta, GA, USA as a market in a campaign you are running. As an ever-prudent marketer, would your intention be to target the city center of Atlanta (Atlanta Proper) and the IP addresses associated with that location? Or, would you expand the geographic focus to include the suburbs, and subsequently, the majority of what is considered the population of Atlanta?

We’re pretty sure it’s safe to assume it’s the latter. As you know, urban sprawl continues to rise, changing the population densities and demographic makeup within cities and in neighboring towns.

Digital Element has accounted for how this trend affects IP geo data, and we’ve gone great lengths to make investments in our technology to help corporate marketing teams and their agencies ensure bi-directional accuracy of IP geo on a meaningful level. What does that mean for marketers?

More is Less

Back to the Atlanta example: let’s say Digital Element provides a marketer with 5.8 million IP addresses for the Atlanta market. Another IP address provider may return almost 6.5 million IP addresses for the same market – a pretty substantial difference, right?

Here’s where the science gets a bit tricky.

At first glance, it may seem like 6.5 million is a more valuable data set. But digging in a little deeper, all of the IPs provided are associated with the city of Atlanta. And, if we do a quick Google search it’s apparent that the population of Atlanta (proper) is just under 500,000. So, where are those other 6 million IP addresses located?

And, how can marketers be confident that they’re accurately targeting the Atlanta metropolitan market if they have no visibility into where the other IP addresses actually are? The short answer is: they can’t. And, hint: this is how IP address databases can be misrepresented and potentially inflated.

In this situation, more is less (accurate).

So what about Digital Element’s 5.8 million IP addresses? The total number may be less, but that is due to good reason: Digital Element maps the IP addresses to their correct geographic locations. This can be further validated by population figures when dissecting the data. Only a small portion of the 5.8 million IP addresses would indicate they are coming from Atlanta proper, and the rest would fall into identifiable adjacent cities.

How does Digital Element do it? Digital Element leverages truth set data from GPS coordinates from mobile devices to validate the location of IP addresses. Put simply, Digital Element receives the latitude and longitude of an IP address when we “observe” a device connecting to the internet using that IP address, and use that to verify the general IP vicinity data Digital Element returns to clients. We can then confirm that an IP address is in a specific city based on the lat/long info received when a device is using that IP address.

Digital Element does this a lot. In fact, Digital Element receives over 950 billion observations from over 1.5 billion devices on a monthly basis. This allows us to section the world into useful geographic segments, no matter how small the city or suburb. Digital Element is the only IP geolocation provider that can do this at scale.

The red color bubbles are the larger number of IPs at the given location. As you can see in the bottom left corner of Atlanta, the red bubble is for the Atlanta Airport, which has multiple network blocks of IPs allocated to it. However, you can also see red bubbles generally on the northside of Atlanta, which is where a larger portion of the metro Atlanta population resides.

When zooming out further to show the region where Atlanta is located, you can see how the IPs correctly represent the rural areas and the more densely populated areas, not the center of the city of Atlanta.

In comparison, a city such as Tokyo has a denser population that reaches further out than the city center. This again is representative of the IPs associated with those areas in this map of Tokyo, overlaid with IPs associated with those areas.

To wrap up, Digital Element provides unparalleled bi-directional coverage for cities and postcodes. We cover them as they were set up by the local government, and map the IP addresses that belong to each.

This is the reason why Digital Element is able to map over 4 million locations (cities and postal codes) in the world, which is an order of magnitude higher than any other provider in this space. For Digital Element customers, this translates into enhanced accuracy, better insights, and greater performance.

Challenges of IP Stability

Another issue that is misunderstood is the fact that IP addresses are not static, and therefore mapping alone can be unreliable. For example, two IP geolocation providers may place an IP address as the same location, but if neither can validate that an IP address was recently “observed” at that location, only relative confidence can be had. Here is why.

Sourcing accurate IP addresses geolocation is not a perfect science. Compounding the fact that it is hard to do, is the fact that it needs to be done often–like, daily basis often.

Because Digital Element sources data from over 750 million mobile devices in a given thirty-day period, and confirms the location of IP addresses using the lat/long provided by the mobile devices, we are able to provide greater confidence as it relates to the actual IP address location.

So, when two companies are matching on an IP address, the physical location provided matters, but nearly equally as important is the last date that IP address was observed, as it is the last confirmed location of that IP address. This is another core competency of Digital Element.

With that said, despite Digital Element’s unique ability to confirm IP address locations, there are still challenges in ensuring accurate location of IP addresses. To address this, Digital Element layers on proprietary methodologies to further validate data and then filter it in order to provide the highest IP address geolocation accuracy available.

Because Digital Element leverages the largest number of datasets in the space, we’re able to contextualize IP address data, therefore helping companies remove useless IP addresses linked to VPNs, cell towers or proxies, that are often erroneously included.

Finally, everything outlined above is underscored by Digital Element’s privacy-centric culture, enabling clients to confidently leverage data to meet the needs of their business. From campaign optimization in AdTech, to threat prevention in Cyber Security, Digital Element takes pride in our ability to provide IP geolocation with the most useful accuracy while leveraging the latest technology to support an evolving landscape.

IP geolocation is an easily misunderstood subject, but one that Digital Element is passionate about “decoding” to bring clarity to security and marketing teams who rely on that data, and validate Digital Element’s unique ability to provide the level of data needed to positively impact your business.

To learn how IP geolocation data can be used across multiple industries, contact us or visit our Use Cases page.

Five Ways IP Intelligence Data Helps Broadcasters

Posted on February 13, 2023September 3, 2024 by Digital Element

Broadcasters serve a vital role in communities across the country. In addition to providing news and information to communities, broadcasters are instrumental to the economy. Per the National Broadcasters Association (NAB), broadcasting accounts for more than 2.28 million jobs in the U.S., and generates $1.03 trillion annually for the nation’s economy.

Given the economic and societal importance of broadcasters, it is vital for them to have accurate data that ensures they deliver the right content, while personalizing the user experience, and protecting the digital rights of content owners. Many have long considered Digital Element as the go-to source for accurate, global IP Intelligence data to help solve some of these challenges.

Let’s look at some of the most important use cases.

#1: Licensing & Copyrights Compliance

Copyright owners never give licensors carte blanche with their intellectual properties. The more people who see or use their audio or video content, the more royalties they earn. Those agreements are negotiated by region.

Digital Element’s IP location and intelligence data helps broadcasters ensure compliance with licensing and copyright agreements. Programming content is served to audiences based on country, state/region, city, and ZIP and postal code, enabling broadcasters to ensure users in prohibited or embargoed areas are restricted from accessing their digital assets. Furthermore, the ability to identify users hiding behind proxies in order to circumvent location restrictions helps broadcasters further protect rights’ holders.

#2: Ad Serving & Content Personalization

Every marketer is keen to display the appropriate content to the right user in order to increase engagement and, ultimately, ROI.

For example, by targeting postal codes near a tentpole event, such as a music festival or a major sporting event – marketers can deliver just-in-time ads to receptive audiences (think: transportation ads to the big event, or ads that drive traffic to a local eatery franchise). Ads that reach consumers at the right place and the right time deliver higher engagement and ROI.

IP Intelligence data is inherently non-invasive, enabling marketers to tap into a wide variety of contextual data so that they can deliver relevant content to the right audiences. . Additional insights, including demographic data, allow brands to target ads relating to a population in an area or region.

#3: Enhanced User Experience

Content delivery networks (CDNs) help ensure a positive user experience by delivering content at the optimal speed based on connection, or ideal format based on viewer’s device. They also process incoming requests and deliver content to any point on the network on demand, while managing entitlements and access to video assets based on the authentication of user rights and integration into the order process.

Digital Element’s IP Intelligence data automatically detects the connection type and speed of the device, helping the CDN to ensure content is delivered at the right speed and format for the device, providing customers with high-quality viewing and sound quality with no delays or buffering interruptions.

#4: Fighting Piracy

Piracy is a scourge that threatens the broadcasting sector, putting protected content, revenue, and even jobs at risk. In its 2021 report, the Motion Picture Association (MPA) estimates that online TV and film piracy costs the U.S. economy a minimum of $29 billion in lost revenue each year, and robs the industry of hundreds and thousands of jobs.

Much of that piracy stems from consumers accessing content that’s outside of their markets — crime they can easily commit using any of the plethora of VPNs available to them. In their defense, leveraging VPN to access out-of-market content is so widespread and common that many consumers may not be aware that this behavior is illegal.

Digital Element’s director of product management discusses piracy at NAB 2022

Digital Element’s Nodify can determine whether inbound traffic is tied to a VPN, proxy, or a darknet, enabling broadcasters to block proxy and darknet traffic proactively, or prompt users for additional authentication (an important consideration as many people use VPNs for privacy or for work, and a global ban of VPN traffic will penalize many legitimate users).

Content pirates are switching tactics, switching from VPNs to residential IP proxy networks to circumvent detection. These are networks that pay consumers to share their internet across devices, and then enable other customers to “rent” that consumer traffic. However, Nodify can detect residential IP proxies, enabling broadcasters to block such traffic.

#5: Enhance Cybersecurity

Web Application Firewalls (WAFs) are important tools for broadcasters, but the rise of residential IP proxy networks has given nefarious actors a workaround. WAFs look at the IP address and geo-location of devices seeking to access a broadcaster’s web applications, and if they are residential and located within the right city or region, grant access. But without additional contextual data around network traffic, like that provided by Nodify, WAFs cannot distinguish between residential IP addresses that are real and those that are proxied.

We advise our clients that protecting their web applications requires a strong cybersecurity posture, especially considering the rise in VPN usage. Layering in threat intelligence insights, such as VPN intelligence data, can help protect your geo-filtering ecosystem; these insights allow streaming media companies to protect revenue by determining which connections pose risks, and prevent bad actors from circumvention activities by identifying anonymized connections, or connections from certain geographies.

The Cost of Cybercrime on Businesses

Posted on February 13, 2023September 18, 2024 by Digital Element

Cybercrime is on the rise, with it projected to cost businesses worldwide $10.5 trillion by 2025.

Cybercrime affects large corporations to small mom-and-pop shops. Just recently, Uber’s network was breached, and sensitive company data was leaked to the public, showing anyone is at threat. However, nearly half of all attacks are aimed at small businesses.

The results of a successful cyberattack range from monetary loss to reputational damage. Therefore, businesses worldwide need to know what they can do to keep their networks and systems safe.

We have gathered data from trusted cybersecurity reports to shed light on the cost of cybercrime on businesses and the need for reliable cybersecurity solutions.

How much do data breaches cost?

Cybercrime is a trillion-dollar industry. A single data breach on a company costs an average of $9.44 million in the U.S. Unfortunately, the initial financial loss is just the beginning; data breaches can also harm a business’s reputation and lead to a loss of current and future customers. This can be particularly hard for small and medium-sized businesses (SMBs) who may not have the necessary resources to weather the reputational fallout of a successful data breach.

How long does it take to detect a data breach?

Threat actors and their tactics get more sophisticated by the day. As such, effectively preventing every single attack on a company is near impossible. Businesses need to have protocols in place to detect and contain breaches as quickly as possible. It takes an average of 287 days to contain a breach. However, if a business can contain a data breach in 200 days or fewer, they stand to save $1.12 million on average.

IP threat intelligence is one way businesses can mitigate the damage of a successful attack. While IP data intelligence won’t stop cybercriminals from trying to attack your network, it will give you the insights needed to make informed decisions to keep data safe and mitigate damage if an attack is successful in breaching your defenses.

How prepared are companies for data breaches?

The pandemic was a blessing in disguise for threat actors. As businesses worldwide switched overnight to remote and hybrid working models, cybercriminals found themselves with a wealth of new network vulnerabilities to exploit. Unfortunately, years later, many businesses still haven’t updated their cybersecurity protocols to reflect these new working models. In fact, 32% of SMBs say they haven’t changed their cybersecurity plan since the pandemic forced them to pivot to remote and hybrid working operations.

Another issue businesses face is cost. Nearly a third of network security professionals say they don’t have the budget to effectively defend themselves against attacks. Furthermore, just half of SMBs have a cybersecurity plan in place.

Cybercriminals are constantly improving and trying new tactics to gain access to sensitive data for their own personal gain. Unfortunately, they don’t care about the devastating effects these attacks can have on businesses and their customers. We hope these alarming statistics help raise awareness about just how damaging cybercrime can be and will inspire people to take action to ensure their networks and systems are secure.

Sources:

https://www.bleepingcomputer.com/news/security/uber-suffers-new-data-breach-after-attack-on-vendor-info-leaked-online

tethttps://www.globenewswire.com/news-release/2020/11/18/2129432/0/en/Cybercrime-To-Cost-The-World-10-5-Trillion-Annually-By-2025.html

https://www.ibm.com/reports/data-breach

Many security executives say they’re unprepared for the threats that lie ahead

Report: Average time to detect and contain a breach is 287 days

https://www.accenture.com/us-en/insights/security/invest-cyber-resilience

2022 Study: 50% of SMBs Have a Cybersecurity Plan in Place

VPN Detection Myth Series: Myth Five – Country-level IP Geo Provides Sufficient Protection

Posted on December 8, 2022September 18, 2024 by Digital Element

A Five-Part Blog Series to Bust the Myths Surrounding VPN Intelligence Data

Over the past few months, we’ve addressed the common questions we hear most frequently when speaking to customers about the rise of VPNs. In our discussions we hear a lot of myths about VPNs — myths that if believed can put corporation information and networks at risk.

To date, we’ve addressed the following myths:

In this final post in the series, we take on the myth that country-level IP geo data provides sufficient protection.

Myth #5: Country-level IP geo provides sufficient protection.

Throughout this blog post series, we’ve highlighted just how easy it is for VPN users to change their IP address to one that appears to originate from another location. In fact, this feature is so ubiquitous and easy that it is positioned as a selling point by VPNs that sell to consumers.

In a blog post, vpnMentor shows readers how to change their region in seconds. vpnMentor is owned by Kape Technologies PLC, which owns the following products: ExpressVPN, CyberGhost, ZenMate, Private Internet Access, and Intego (which speaks to blog number 3 in this series, Covering the Top 10 VPN Services is Sufficient).

This begs the question: how much should you trust an IP location as a proxy for a legitimate user? Let’s say a company has a policy to block all IP addresses that originate in Russia or Iran for security purposes. But does this policy actually provide any protection for the company? The answer is no, given how easy it is to change one’s IP address geographic location.

Conversely, there are good and bad VPN providers and users in every country, including the U.S. If you block users on a country level, you may inadvertently block legitimate users, some of whom may be your own employees or customers.

Let’s say an R&D company blocks IP addresses that originate in Iran. All traffic coming from that country would be deemed nefarious, right? But what if that company sent a team of scientists to present a paper to the International Conference on Science Technology and Management, which will take place in Tehran? The company’s scientists would be prevented from exchanging email with their colleagues back at home.

It’s All About Context

Here’s the reality: IP address data alone won’t protect your corporate network, but it will provide substantial context about incoming traffic. From there you can make intelligent decisions, and establish best practices, as to how to treat VPN traffic.

For instance, some VPNs offer features that are friendly to criminals, such as payment via untraceable crypto currencies, no logging which enable them to cover their tracks. If a crime against your network occurs, such VPNs will not assist you or law enforcement in tracking down the perpetrators.

Other VPNs tout the fact that users can easily change their IP address in order to bypass digital rights access restrictions, as the above example illustrates.

You may not want users of such VPNs to access your network, regardless of where they reside. In fact, you establish a set of best practices that bar users from your network based on the VPN service they use. But to implement such rules, you’ll need access to that rich contextual data in order to set access rules for your network.

The Digital Element Difference

Digital Element’s Nodify provides a rich set of IP address intelligence data so that you can understand the context of users who access your network, including:

VPN classification
Provider’s name/URL
Distinction between residential or commercial
IP addresses related to a provider

With this data in hand, you can make smart decisions about the VPN traffic that accesses your network, and set rules to enforce it. For instance, you can opt to flag all commercial VPN traffic with additional multi-factor authentication automatically.

To learn more about VPNs and how to incorporate IP geolocation and intelligence data for corporate network protection, download our white paper “The Need for Proxy/VPN Data in Today’s Heightened Cybersecurity State.”

Fight Ad Fraud with IP Intelligence Data

Posted on December 1, 2022November 11, 2024 by Digital Element

Ad fraud is a pernicious challenge, but it doesn’t need to be. With the right tools in place, invalid traffic and bots can be seriously curtailed, as the recent TAG Fraud Benchmark reveals.

There’s one tool that can help advertisers and affiliate marketers distinguish legitimate traffic from nefarious actors: IP intelligence data.

What is IP Intelligence Data?

An IP address is the unique address that identifies an Internet-connected device, be it a computer, mobile phone, or connected TV. Without it, the Internet wouldn’t be able to tell one device from another, and data would be misdirected.

All IP addresses contain a great deal of context — i.e. intelligence data — that surrounds the actual address, including:

Geolocation data (country, city, zip/postal code)
Proxy data (e.g. masked IP data that can be used by fraudsters)
Devices and Services (e.g. Web server)
Home usage vs. business usage
Company name
VPN provider & URL

IP data can help teams detect fraudulent clicks that originate from click farms or bots, thereby ensuring that budgets are spent showing ads to real humans.

Digital Element IP-Based Ad Fraud Detection Tools

IP data origin differs from provider to provider. Digital Element’s NetAcuity uses patented technology, along with over 20 proprietary methods to gain context into IP addresses. We also partner with companies that provide device-derived data from SDKs and apps, which enhances our ability to see more IP addresses, and improve our decisioning.
Nodify is a threat intelligence solution designed to help data scientists and Traffic Quality teams respond to the rise of VPN usage and the threats they pose to the digital advertising ecosystem. Nodify helps Traffic Quality teams assess VPN and Proxy traffic by delivering contextual insight around an IP address, including: VPN classification (VPN, proxy, or darknet), whether it supports fraudster-friendly features such as no logging or payment via crypto, IP addresses related to a provider, traffic type and more.

Distinguish Real Traffic from Fraud

Identify proxies used by fraudsters	Identify proxy data, which may be masked IP data that can be used by fraudsters. Distinguish between risky and benign VPNs. Identify where ads are viewed; are they in a region of the world that makes sense for the campaign? Identify when a bunch of “interesting IPs” appear but can’t connect them to anything.
Identify click farms and app-install farms	Determine fraudulent clicks and ensure budgets are spent on real impressions seen by real humans. Identify when a suspicious number of clicks come from a specific radius or timeframe.
Identify mobile proxy farms	Determine which mobile IP addresses are legit. Identify mobile IP addresses that never move.
Bot mitigation	Compare the entrance and exit nodes to identity when bots are blended in with residential traffic.
Create best practices	Use Nodify data to create inclusion and exclusion lists based on context. Distinguish between corporate VPNs and those with nefarious features.

To learn about IP address data and the role it can play in a marketing organization, access our guide, “A Guide to Understanding How IP Data Helps Marketers.”

VPN Detection Myth Series: Myth Four: VPN Threat Vectors are Far from Static

Posted on November 10, 2022September 3, 2024 by Digital Element

A Five-Part Blog Series to Bust the Myths Surrounding VPN Intelligence Data

In this five-part blog series, we tackle the questions our customers ask us, with a goal of busting the myths that are driving those questions. In our first blog post of the series, we dispelled the myth that all VPN-driven data is the same. For Part Two, we addressed the myth that VPN breadth doesn’t matter. Part Three dispelled the myth that IT teams only need to worry about detecting the VPN services included in a Top Ten list they’ve found online.

This blog post, the fourth in our series, tackles a pernicious myth that VPN threat vectors originate from common sources and remain static.

Myth #4: VPN threat vectors originate from common sources and remain static.

There are many reasons why this statement is false. Before we can even begin to identify the IP addresses that are proxies, we need to understand how the IP address space operates. There are three portions of the routable IP space that apply in this context:

ISP blocks, which are tied to ISPs that offer home and business connectivity
Mobile blocks, which are for mobile and IoT devices and provided by telecom companies
Hosting IP blocks, which is where VPN activity originated and continues to live, services all kinds of connectivity needs, such as domain or web hosting, co-location, and so on.

However, over the past 10 years, VPN providers have begun to tap into IP addresses that historically have been within Hosted IP address blocks to dynamic addresses within the ISP and Mobile blocks and are starting to leverage those as proxies.

Dynamic vs Static IPs

Given the distinction in the routable IP space, it’s no surprise that there are two broad classes of IP addresses: static and dynamic.

Static IP Address. A static IP address is one that has consistent geolocation, meaning at the time it is analyzed its geolocation is the same as previously identified. Static IP addresses are likely tied to the same end users if within an ISP block.
Dynamic IP Address. A dynamic IP address is one whose geolocation changes frequently. It’s dynamic because it can service different end users at any given moment. This is more common in Mobile and ISP blocks because end users fluctuate within a given area. These addresses are difficult to block as the end user may be different every day making blocking the IP address problematic.

Example of a Dynamic IP Address

A home user’s IP address, also known as a residential IP address, is a highly valuable IP address to a VPN provider as they are dynamic and can change everyday. A VPN service will use these addresses for their service, knowing that the IP address can change at any given moment, making it easier to circumvent restrictions that would apply to Static IP addresses.

Example of How VPN Exit Nodes Operate

Lets say a user signs up for “Big Name” VPN user and connects to a server in the U.K. They will be assigned a Static IP address of “1.2.3.4” from a hosting provider like “Digital Ocean”. That is the entrance node. The “Big Name” VPN user then wants to visit a streaming media provider. At that point the provider routes the user through an additional IP address “5.6.7.8” from an ISP like “British Telecom”. This is the exit node. And this is the IP address that looks like a residential IP address.

Furthermore, if the “Big Name” VPN user leaves the U.K. server and chooses a U.S. server from the “Big Name” VPN provider, that IP address is “9.10.11.12” and it belongs to a hosting provider, such as “Linode LLC”. This is the entrance node. If the user connects to a media streaming service, they get routed through “13.14.15.16 ” which belongs to an ISP “Comcast Cable”. This is the exit node and this is also another residential IP address.

It’s also a good example of the challenges it poses to companies that offer services to that user. Once upon a time, security teams could reasonably assume that an IP address associated with a proxy was a bad actor who should be blocked from accessing their networks or services or a bot performing a malicious action. But we see in this example that a home user can be associated with a proxy. If you’re a streaming media company, do you still block this home user, who may be a paying customer?

The Bottom Line

What does this mean for security teams? You can identify an IP address as a threat vector and block it, but that is no assurance that you’ve stopped the bad actor. That actor can simply access and use another IP address to attack your network. This is when the process of blocking certain entities can begin to look like a game of whack-a-mole.

The Digital Element Difference:

We deploy multiple strategies to help security professionals to stay on top of threat vectors.

First, we identify which IP blocks are static and which are dynamic using proprietary methodologies. Additionally, we use several different applications, each with its own methodology, to identify the IP addresses that are currently being used as proxies.

Importantly, we also see the volume and frequency of both static and dynamic IP addresses that are tied to VPNs. We can verify that dynamic IPs tied to VPNs remain predominantly in the Hosting space, even as VPN providers are actively moving into static IP space.

Given the dynamic nature of the space, we also have a very robust aging mechanism to ensure that we don’t label an IP address as a proxy longer than we should. This aging mechanism also runs 24/7.

Up Next: In our fifth and final myth of this series, we’ll talk about the pitfalls of relying only on geolocation datasets, and explain why blocking an entire geographic region isn’t always in your best interest.

Trick or Treat? How the Explosion in VPN Usage Impacts Cybersecurity

Posted on October 26, 2022September 3, 2024 by Digital Element

VPN usage exploded during the pandemic, as consumers sought ways to hide their location so that they could circumvent geographical restrictions to content. Consumers face no difficulty in finding a VPN service provider, as a plethora of free and paid residential proxy services have entered the market.

Some of these VPN services are favored by nefarious actors because the service offers features that allow them to mask their malicious activities, including scraping, scanning and network password testing. The FBI has warned that cyber criminals are exploiting home VPN usage to break into corporate systems.

As a result of this surge in the VPN market, it’s essential that security professionals gain a deep understanding of the VPN market so they can properly protect data and network assets. Knowing which VPN providers promise criminal-friendly services can help you make important decisions about the traffic that can access your network, and set policies to keep nefarious actors at bay.

Organizations Need Granular Detail Around VPN Traffic, Usage, and Intent

Earlier this year we introduced, Nodify, a threat intelligence solution that identifies whether inbound or outbound traffic is tied to a VPN, proxy, or a darknet. Nodify provides security professionals with a wealth of context around VPN providers to help you distinguish legitimate users from bad actors.

Recently we’ve made important updates to Nodify, making it the most extensive VPN detection system available. The notable updates are:

Higher Frequency: With proxy IPS and VPNs changing rapidly, Nodify data is collected on an hourly basis and provides customers with a daily update on usage.
Deeper Insights: Going beyond the generic VPN collection, Nodify provides users with critical insights into the VPN user, including services provided by the VPN provider such as “no logging,” “multihop,” and “corporate.” These fields help clients determine the good vs the bad based on their use case.
Ease of Use: Nodify has a user interface that allows clients to quickly get a complete understanding of any VPN provider through a simple web dashboard.

Treat Yourself to Our Cybersecurity Brief Today

We recently published a cybersecurity brief, “The Need for Proxy/VPN Data in Today’s Heightened Cybersecurity State” which is available for download today.

Created to help security professionals understand and respond to the surge in VPN providers and usage, this brief describes the new classes of VPNs that have emerged during the pandemic, how they exploit consumer usage, and the unique risks they pose to corporate systems.

It also provides concrete steps that security teams can take to protect their networks proactively using Nodify insights.

Download “The Need for Proxy/VPN Data in Today’s Heightened Cybersecurity State” today.

VPN Detection Myth Series: Myth Three – Covering the Top Ten VPN Services is Sufficient

Posted on October 13, 2022September 18, 2024 by Digital Element

A Five-Part Blog Series to Bust the Myths Surrounding VPN Intelligence Data

In this blog post we take on the myth that corporate security and IT teams only need to worry about the ability to detect and screen the VPN services included in a Top Ten list they’ve found online. But as you’ll see, there are flaws to this strategy.

VPN usage continues its upward trajectory. Today nearly one in every three people worldwide use one, making VPNs one of the most popular pieces of consumer software. Among the biggest reasons people use VPNs are security (43%), streaming (26%), and privacy (12%).

As any IT professional knows, the increased popularity means increased risk. VPNs have been popular tools for cybercriminals, who use them to obfuscate their original location, circumvent firewall blocks or even deep packet inspection, among other things. Once a nefarious actor has breached a network through a compromised device, such as the work PC of a remote worker, the entire network is at risk. In January of this year, police in Europe shut down VPNLab, a VPN service that cybercriminals used to distribute malware and ransomware to over 100 businesses throughout the continent. These cybercriminals were able to avoid detection tools because the VPN encrypted the traffic to the endpoint.

For publishers, people using VPNs for streaming may often be circumventing digital rights management rules put in place to prevent piracy from siphoning off revenues. In fact, piracy is expected to skyrocket as inflation and subscription fatigue collide. Content owners and operators are fighting to protect intellectual property, and are finding that fighting piracy and protecting content assets is coming down to a cybersecurity issue within their organizations.

These are not idle concerns. Naturally, corporate security teams are keen to understand the VPN market better, including which services are favored by bad actors and which are more benign. It’s a topic we’re asked about frequently, and are happy to provide our clients with the insight and tools they need to make smart decisions regarding who can access their networks, who should be flagged for additional authentication, and who should be blocked altogether.

Myth #3: Covering the top Ten VPN sites provides sufficient protection.

Fact:

Google “Top Ten VPN sites” and you’ll get a plethora of results. In fact, Google returned 53 million results in less than one second. Some of the Top Ten lists are created by well known entities, such as Forbes, Security.org and CNET, while others, like Top10VPN.com, should raise alarm bells.

But even if the source is reputable, should you trust its analysis? Take the Forbes list, which analyzed VPNs for the key features that Forbes editors value, namely cost and number of servers worldwide. The top VPN selected, Private Internet Access, was chosen because it “strikes a perfect balance of pricing, features, and usability.” To their credit, Forbes notes that some security teams are uncomfortable with its “checkered past.”

We at Digital Element are uncomfortable with the whole notion of a Top Ten VPN list, and the advice it delivers. How many VPNs were analyzed to begin with? How were they selected? In the case of Forbes, that data is absent from its report.

In its The Best VPN of 2022 list, Security.org tells readers that its security experts analyzed “dozens” of VPNs, to determine which are the best. How many dozen? And why were they selected? If a VPN wasn’t analyzed, can we assume it’s safe? How should the security team treat traffic that comes through those unanalyzed VPNs?

This is the challenge with relying on Top Ten VPN lists. On the whole they are a meaningless metric for a variety of reasons, all of which are well worth exploring. For starters, there are way more than 10 VPN services in the world today. In fact, there are way more than dozens of services. There are literally thousands of existing services, with new entrances occurring daily. In such an environment, how can anyone claim which ones ought to be included in a list of Top Ten? From our take, the most popular VPNs in the Top Ten lists are affiliate links that pay the person promoting the VPN. You can see in this list, the commissions for a sale. There is quite a lot of money in it. It’s no wonder so many people promote them.

Second, some VPNs are more concerning to specific industries than others. If you’re a company that streams copyright-protected content to subscribers, the commercial VPNs are more relevant to you than corporate VPNs. Many of the VPNs boast the ability to circumvent digital rights access parameters, which is a direct threat to your business. Consequently, your list of Top Ten VPNs will be based on a different set of criteria than a global retailer’s.

Third, the lists themselves are very suspect. While there are thousands of VPN services, many are owned by the same set of parent companies. For instance, 105 separate VPN services are owned by just 24 companies. As it happens, the VPN parent companies also own the review sites, which means they’re essentially grading their own homework. Kape Technologies owns multiple VPN services, including ExpressVPN, CyberGhost, Private Internet Access, as well as a collection of VPN review sites. There is an obvious conflict of interest between owning a service and writing its review.

This is a significant issue in the VPN space. In fact, U.S. lawmakers recently asked the Federal Trade Commission (FTC) to examine the promises VPN service providers offer consumers, as a study revealed that 75% of them make exaggerated or outright false claims about the level of protection and privacy consumers can expect.

The Digital Element Difference

Digital Element has a policy to review and classify all new VPN services as they emerge. We also monitor more than ten — or even dozens of VPN services. Currently, we monitor 361 VPNs, 56 proxies, and two darknets, which we’ve identified through mapping out the entire provider network and identifying darknet nodes.

We go beyond determining if a service is a VPN or proxy, we also go to the source of where those VPNs exist. We also provide contextual information about the VPN provider itself, a feature that is unique to Digital Element.

For instance, we provide nearly 20 fields about the provider, ranging from ID, Provider, Site URL and whether it’s a paid or free service, to location and whether it accepts crypto payment.

The rich detail we provide allows security teams to establish best practices for VPN traffic. For instance, you may opt to ban all users who use a VPN that has no paper trail, accepts payment in crypto or located in a region of the world where you have no customers, offices or employees.

Next Up: VPN threat vectors originate from common sources and remain static. Or do they? We’ll dig deeper and report on what our proprietary technologies reveal.

Kicking off Cybersecurity Awareness Month Like a Champ

Posted on October 3, 2022September 3, 2024 by Digital Element

Did you know that October is Cybersecurity Awareness month? We have answered the National Cybersecurity Alliance’s call for cybersecurity champions, because we share the Alliance’s dedication to promoting a safer, more secure and more trusted internet.

Founded in 2004, Cybersecurity Awareness Month, is the world’s foremost initiative aimed at promoting cybersecurity awareness and best practices. Led by the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA), Cybersecurity Awareness month is a collaborative effort between government and industry to raise cybersecurity awareness nationally and internationally.

A 24/7 Mission for Digital Element

It’s important to note that our dedication to cybersecurity isn’t limited to the month of October. Everyday we help security teams across the globe protect their networks against cybersecurity threats and attacks.

Moreover, we work continuously in developing new tools and relationships so that we can provide security teams with more data, insights and tools they need to keep their network and customer data secure. For instance, we recently announced enhancements to Nodify, our threat intelligence solution which provides critical context surrounding VPN traffic, enabling cybersecurity teams to understand the level of threat such traffic poses, as well as set policy around that traffic.

Education is critical to achieving our mission, and in that vein, our employees, recognized domain experts in the field, share their insights on emerging trends and security strategies by authoring white papers, presentations and articles for the benefit of the cybersecurity commission.

In the spirit of raising awareness around cybersecurity, we’ve collected some educational materials for you to access, including:

The Need for Proxy/VPN Data in Today’s Heightened Cybersecurity State. This white paper looks at the meteoric rise in VPN usage, the new classes of VPNs that have emerged and the risks they pose to corporate security. It also addresses how corporate security teams can apply rules to mitigate those risks.
How IP Data Can Help Security Professionals Protect Their Networks, an article penned by Jonathan Tomek, VP of Research and Development, Digital Element. In it Jonathan discusses how beefing up security requires a combination of forensic efforts and proactive mitigation.
How IP address data can bolster cybersecurity for federal agencies and their contractors, an article written by Justin Skogan, Vice President of Enterprise Sales for Digital Element. Justin taps into his deep expertise servicing federal agencies, and highlights areas where they can shore up their cybersecurity in the face of emerging VPN threats.
VPNs, Remote Working, and Cybercrime: How It Professionals Can Tackle 2022’s Rapidly Growing Threat, another article written by Jonathan Tomek, which goes into some of the specific risks that remote work poses to corporate security.
Three Ways IP Data Can Enhance Cybersecurity, also by Jonathan Tomek, that provides practical steps security professionals can leverage IP data to improve their cyber security.

Cybersecurity is all of our concern, and we all play a role in promoting a safer, more secure and trusted internet. Together we can achieve those goals.

About Cybersecurity Awareness Month

Cybersecurity Awareness Month is designed to engage and educate public- and private-sector partners through events and initiatives with the goal of raising awareness about cybersecurity to increase the resiliency of the nation in the event of a cyber incident. Since the Presidential proclamation establishing Cybersecurity Awareness Month in 2004, the initiative has been formally recognized by Congress, federal, state and local governments and leaders from industry and academia. This united effort is necessary to maintain a cyberspace that is safer and more resilient and remains a source of tremendous opportunity and growth for years to come. For more information, visit staysafeonline.org/cybersecurity-awareness-month/

VPN Detection Myth Series: Myth Two – VPN Breadth Doesn’t Matter

Posted on September 26, 2022September 18, 2024 by Digital Element

A Five-Part Blog Series to Bust the Myths Surrounding VPN Intelligence Data

No trend deserves the corporate security team’s attention more than the explosion of VPN usage, as well as the influx of VPN providers to the market.

The numbers speak for themselves:

By 2027, the total VPN market may reach $92.6 billion.
Consumers will contribute to the growth; per IDC, the market for consumer VPNs will double in size, reaching $834 million by 2024.

Countless people will attempt to access corporate systems and websites via a VPN service, forcing security teams to make decisions as to which are legitimate, which are suspect, and which are likely to have nefarious intentions.

In our first blog post of the series, we dispelled the myth that all VPN-driven data is the same. In this post we take on the myth that VPN breadth doesn’t matter.

Myth #2: VPN breadth doesn’t matter. Once you know the entrance IP addresses you have the VPN covered.

Fact: Google “VPN providers” and you’ll see plenty of Top 10 or Top 25 lists, few of which contain the exact same providers. How many VPN services are there exactly? It’s a difficult question to answer, but it’s probably somewhere in the thousands. With that many providers, breadth absolutely matters!

Let’s start with some basics. Not all VPN services are the same. Broadly speaking, there are four main types:

1. Commercial VPN aka Personal VPN

This is a service that’s geared to individual or personal use rather than business use. Personal VPNs are used to protect a home or office computers and devices from external attacks. They’re also used to circumvent geography-based restrictions to content. These can be used on mobile devices, laptops, and home routers.

2. Corporate VPN aka Remote Access

This is a service that allows employees who work remotely to access and use their employers’ corporate data, systems and applications. All traffic between the user and the corporate network is encrypted.

3. Private Relay

This is designed to enable privacy for an individual without allowing them to circumvent geography-based restrictions. The goal of these types of VPNs is to encrypt network traffic to prevent data snooping.

4. Site-to-Site VPN

This is a connection between two or more networks, such as a network within a corporate HQ and one in a local branch office.

Complicating matters further, VPN infrastructure can be quite broad with numerous entry and exit points that change frequently. For instance, a commercial VPN service allows a user to enter the VPN via a US-based IP address and exit it via an IP address that’s located in another country. This allows the user to bypass any geo-restriction policies — an action that you will miss if you have just the US-based point of entry IP address.

Keep in mind that there are many free and low-cost commercial VPN services on the market that offer simple interfaces that allow users to change the location of their IP addresses quickly and easily. In fact, many services offer this functionality as a key selling point.

This means that an employee can also use a personal VPN service from within your corporate campus to circumvent your internal company policies, such as one that bans streaming videos while in the office. Worse, a VPN can be used to exfiltrate internal data outside of the network — an event that security tools can’t always detect.

The bottom line: One IP data point — either the entrance or exit point — is like one hand clapping.

The Digital Element Difference: We are an IP address intelligence data provider that tracks both entrance and exit points of your traffic, which means we are the only company that can eliminate these blindspots for you.

Our breadth of data provides the context you need to protect your corporate network by establishing and implementing best practices about VPN traffic.

Next up: The common myth that covering the top 10 VPN sites provides sufficient protection. We look forward to giving you the whole story on this.