This applies to any country, but here's some context:
- Website: BBC iPlayer (a major UK streaming website, registration mandatory)
- Server: Linode, London data centre
- VPN: SoftEther on HTTPS port 443
- Country of stay: South Africa
This is a standard situation for residents of country X visiting country Y to try to gain access to a service geo-restricted to country X.
What APIs could be exposing the South African location? I say location as context broader than IP addresses should be considered. The following spring to mind:
- Cached HTML5 geolocation API
- Cookies on third party websites exposing the client once in South Africa when not using the VPN and a timeout realising the flight time to get from country Y's capital city back to country X's is too short
- Installation of the country X website's iOS/Android app revealing GPS location combined with the "flying time" methodology in point 2
- The website having knowledge that certain IP blocks are from "eyeball" networks (the major ISPs... i.e. ALLOW) and others are from "content" networks (the major cloud providers... i.e. VPN i.e. BLOCK)
- WebRTC revealing a private 10.10.0.2 IP which is a typical VPN IP allocation although I can easily change such a DHCP setting on the server
- Ping packets (or an HTML5 simulation of such) revealing 300ms latency to an IP claiming to be from city X, when the provider's streaming server is also in city X
Are there any approaches I may have missed?