Evidence
Certificate attribution
VPN operators identify themselves in their own certificates. The issuer and subject fields are read.
Commercial VPN operators run a private certificate authority for their server fleet and identify themselves in the issuer field.
| Certificate field | Example | Tells us |
|---|---|---|
issuer.common_name | CyberGhost Root CA | The operator |
issuer.organization | Private Internet Access | The operator |
subject.common_name | paris-rack410.nodes.gen4.ninja | Often the site — here, Paris |
Attribution independent of probing: it applies to hosts never routed through. It has also identified providers absent from the probing configuration; TorGuard, with several thousand addresses, was found this way.
Claimed against observed location
The subject name frequently encodes the advertised site. Compared against the observed egress location, this yields virtual server locations: a host presenting as Paris that responds from Frankfurt. See Virtual locations.