Why this topic matters to me now
Strange egress irritates antifraud intuition. VPN, corporate proxy, CGNAT, mobile NAT — it all looks “not like the home ISP from an ad”. The temptation to stamp automation is huge.
An honest person on a VPN looks “odd” to a naive score. I train myself to separate network context from automation signals. The diary formula: network is context, not identity.
Public frame (links)
Public literacy on WebRTC and ICE is in MDN RTCPeerConnection. The philosophy of “not one hash / look at consistency” appears in open materials such as detect.expert. The words that matter to me are “context” and “not a verdict”.
What I observe in the lab, in general terms
Egress ≠ identity
A person on a train on VPN remains a person. Automation on a “pretty home IP” remains automation. The network adds a plot; it does not replace the investigation.
If I put nuclear weight on a “strange IP”, I punish business travel, public Wi‑Fi, and common sense.
STUN/ICE as a public topic
Candidates sketch network topology in rough strokes. Useful for context and dangerous as a sole verdict. I do not turn the network layer into morality, and I do not publish recipes for swapping candidates.
How to talk to the reader without panic
“The network looks unusual” → “which other layers are consistent?” If the rest look everyday, I do not start a witch hunt. If room, claim, and behavior disagree — the network is one chapter, not the whole novel.
What this changes in detect and/or in the build (without specifics)
In detect I lower the temptation of nuclear weights on VPN. In the build I do not treat “exit on a pretty IP” as the goal of a profile-consistency experiment. A pretty IP without layer consistency is stage decoration, not a win for the method.
What I will not say and why
No ICE-swap recipes, no bypasses of specific antifraud via STUN, no tunnel schemes “for a site”.
Short first-person takeaway
VPN and STUN help understand the scene. They make poor judges. In the lab diary the network stays scenery, not a sentence for the actor.
