My honeypot caught a hack attempt from an IP that was issued by Three Mobile Broadband (UK).
My immediate thought was that most probable explanation was that the user was in the UK and had his laptop hooked up to a cell data stick. But it got me thinking:
Would it be possible for the user to be in Romania, use a cellular phone or data stick from a UK provider, and get an IP from the UK? Or, would the user have to be in the UK to get an IP from the UK provider?
I do not know things like:
- when does an IP address get assigned to a cellular Internet connection? As soon as it hits the local data network, or does it complete a cellular data network routing before it hits Internet?
- are cell-to-cell connections possible on data networks? Like a VPN, but over GSM.
- what options are there for a hacker to use cellular data networks to anonymize his traffic?