lesson_07: ip changed. signal remained.

what the tool shows

the tool shows two snapshots:

• before the ip change

• after the ip change

but this is not a full identity reset

it is only a partial state change

what actually changed

when you switch vpn, the most visible signals often change first:

• public ip

• geo

• asn / provider

• exit node

this looks dramatic

but it is only one layer

what often stays the same

many higher-layer signals can remain stable:

• cookies

• local storage

• session storage

• login state

• language

• timezone

• screen profile

• pixel ratio

• hardware hints

• canvas output

• webgl renderer

the system does not need everything to stay the same

it only needs enough overlap

why ip is weak

an ip is:

• a network coordinate

• a routing value

• a source address seen at one layer

an ip is not:

• a person id

• a browser id

• a session id

• a device id

examples

example_a :: shared source

environment
1 office

people
200 employees

network
1 public egress ip

result
many users can appear as one source

example_b :: rotating path

subject
1 person

path
home wifi
mobile network
vpn exit

result
one user can appear under multiple ips
in a single day

this is why:

• same ip != same visitor

• new ip != new visitor

the layer model

layer_1 :: network

signals

• ip

• geo

• isp / asn

• vpn / datacenter hints

question
where did the request come from

layer_2 :: session

signals

• cookies

• local storage

• session storage

• login continuity

question
is the browser still carrying old state

layer_3 :: browser

signals

• language

• timezone

• platform

• screen size

• pixel ratio

• hardware concurrency

• device memory

question
does the browser still look structurally similar

layer_4 :: rendering

signals

• canvas

• webgl

• graphics quirks

• audio behavior

question
does the client still behave the same way when asked to render

layer_5 :: correlation

signals

• what changed

• what stayed stable

• how much overlap remains

question
is continuity still possible

what the comparison really means

the tool is not proving:

• this is definitely the same human

the tool is showing:

• which signals moved

• which signals stayed

• which layers preserved continuity

example outcome

• ip changed: yes

• geo changed: maybe

• asn changed: maybe

• language changed: no

• timezone changed: no

• screen profile changed: no

• storage continuity: yes

• rendering traits changed: little or none

reading
the route changed
the client surface mostly remained

the engineering point

real systems usually do not ask:

• did the ip change

they ask:

• what stayed stable across the change

that is the shift

from

• single-value thinking

to

• layered correlation thinking

the main lesson

identity in real systems is often not:

• one field

• one value

• one perfect key

it is often:

• approximation

• correlation

• continuity over time

final line

changing the ip changes the route

it does not necessarily change the visitor