// post-mortem
How to not get
skidded.
You just had your IP, city, ISP, and live weather pulled by a page that cost approximately zero dollars and zero hacking skills to build. It was a free API call. A golden retriever with a laptop could have written this. Here is how to make sure it does not happen to you again.
Use a VPN — a real one
Your IP is the first thing any script will grab. A VPN masks it behind a shared exit node. Pick a provider with a proven no-logs policy (Mullvad, ProtonVPN). Free VPNs are worse than nothing — they sell your data to pay the bills. Also: turning your VPN off "just for a second" is how people get caught.
Stop using your real browser
Chrome fingerprints you across every site you visit even in incognito. Use Firefox with uBlock Origin, or better yet use the Tor Browser. Your browser leaks your OS, screen resolution, installed fonts, timezone, and language — all of which combine into a fingerprint more unique than your IP.
Never click random links on your main machine
This page collected your real IP and approximate location just because you opened it. Use a VM (VirtualBox + a clean Linux install) or at minimum a separate browser profile with a VPN active before clicking anything sketchy. Assume every link is this page.
Your metadata is louder than your content
Encrypting a message hides what you said. It doesn't hide when, to who, from what device, or from what location you sent it. Metadata is how people actually get caught. Use Signal. Enable disappearing messages. Don't use your real phone number to register it.
Compartmentalize everything
Separate identities for separate activities. Different email, different device or VM, different VPN exit node. Never cross the streams. The moment you log into a personal account from the same session as anything sensitive, you've linked them forever in some server log somewhere.
Update your threat model
Most people are not being targeted by nation-state actors. Your actual threats are: doxxing from an angry forum user, phishing, credential stuffing from old data breaches, and your own OPSEC mistakes. Check haveibeenpwned.com, use unique passwords (password manager), and enable 2FA on everything. Basic stuff stops 95% of real-world threats.
$ sudo rm -rf /your/opsec_mistakes
Password: _
[sudo] password for skid:
// it was already too late before you got here