Find location of VPN connection

We have a web application firewall in place with GEO IP protect enabled. The GEO IP protection allows only traffic within Canada to our site. In Google analytics, it shows a connection from Asia. We tracked down that these connections are related to a client in Canada based on login name. We believe that the connection in Asia is bypassing the GEO IP protection using a VPN to this client’s network. Is there a method of proving this? Finding the VPN origin? Is there another way other than VPN? Any suggestions welcome. Thanks

baysys said:

We have a web application firewall in place with GEO IP protect enabled. The GEO IP protection allows only traffic within Canada to our site. In Google analytics, it shows a connection from Asia. We tracked down that these connections are related to a client in Canada based on login name. We believe that the connection in Asia is bypassing the GEO IP protection using a VPN to this client’s network. Is there a method of proving this? Finding the VPN origin? Is there another way other than VPN? Any suggestions welcome. Thanks

Click to expand...

there are customs to research the case when the VPN connection with particular GEO IP addressing is passed through the web application firewall. Here's how:

IP Address Check: Some common and easily available services include WhatIsMyIP. com, the location of the client’s IP”, etc. If it is different from Canada during a presumed VPN connection, then it confirms a breakthrough.

Investigate Login Behavior: Investigate the login activity and compare it with the ones coming from Asia. Any anomalies that can be detected such as log-in at certain times or frequency that is peculiar to the VPN usage by the client can also suggest the use of a VPN.

Contact the Client: It is advisable to contact the client and ask if he has used any means of transportation lately or has used VPNs. Their response may help the dripping analyst to lean how things are at the company, although it is not a conclusive evidence.

However, as far as possible ways to avoid GEO IP restrictions are considered, VPNs are the most popular, but not the only ones: there are others like for instance proxy servers. Nevertheless, the above methods can still provide the necessary input for recognizing comparatively fresh odd behavior.