Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A website can log the internet address used by each visitor. In the episode described by the Global Investigative Journalism Network (GIJN) and Freedom of the Press Foundation (FPF), New York Times office IP addresses appeared repeatedly in a subject’s website logs, revealing that the newsroom was investigating and tipping off people connected to the subject. The key lesson is that ordinary web browsing can expose investigative interest—not that an IP address by itself proves who was at a keyboard.
How the newsroom’s IP address revealed its interest
When a browser requests a page, the website receives network information that includes the source IP address associated with the request. A site operator can record that address in server logs. If the address is recognizable as belonging to a news organization, visits—especially repeated ones—may signal that its journalists are looking into the site or its owner.
FPF recounts that New York Times office IP addresses appeared in server logs and tipped off a New York politician and his son, who were connected to the subject of the reporting. GIJN says the tip-off was disclosed in a U.S. court document. GIJN dates that document’s disclosure to 2015 and links to a CyberScoop account published in 2017; those dates describe the disclosure and subsequent coverage, not necessarily when the underlying visits or tip-off occurred. GIJN’s digital-security guide and FPF’s VPN explainer describe the episode.
An IP address identifies a network connection, not a person. But a recognizable newsroom address can still disclose a reporting lead: the site owner need not know which reporter made each request to infer that the newsroom is paying attention.
#1 Best Overall
- LIFETIME PRIVATE BROWSING INCLUDED: Built-in decentralized VPN service delivers always-on privacy without subscriptions, masking your IP and encrypting traffic as you roam with this portable wifi and vpn router, ideal for privacy-conscious travelers and remote workers.
- LIGHT DAILY CONNECTIVITY TIER: Designed as a low-overhead portable router mode for light browsing and messaging, this setting trims background chatter and quietly blocks intrusive ads to stretch limited hotel or café bandwidth, helping privacy-minded users keep everyday email, social feeds, and cloud notes responsive without burning through data or battery on the go.
- OPTIMIZED POCKET ROUTER CAPACITY: Tuned as a compact portable wifi router for 1–3 small devices, this pocket router balances speed and stability so your phone, tablet, or laptop stay reliably connected without slowdowns, ideal for focused solo work sessions or minimalist travel setups.
- SMART CONTENT FILTERING CONTROL: Intelligent traffic management automatically prioritizes video and music streams while enabling smart ad blocking and simple parental controls, helping this portable wifi router keep casual entertainment smooth and family browsing more focused without extra apps or complex setup, ideal for relaxed evenings or kid-friendly screen time.
- ENTERPRISE-GRADE THREAT DEFENSE: Enterprise-grade firewall hardening, tracker blocking, and DNS-layer malware shielding work together on this portable wifi router to quietly stop suspicious sites and risky connections before they load, reducing phishing and data-theft exposure for privacy-first users who treat every network like a hostile one.
Why the Alfa-Bank DNS story is different
The Times IP-address episode is sometimes easy to conflate with a separate controversy involving Alfa-Bank and DNS requests for mail1.trump-email.com. They are different kinds of evidence. A website server log can show requests reaching that website from an IP address; a DNS lookup is a request to resolve a domain name to an IP address. A lookup alone does not show that the requester then connected to the destination host.
A July 21, 2017 Senate letter reproduced a Mandiant review of evidence the Times provided to Alfa-Bank: 61 pages of apparent passive DNS logs showing requests from two Alfa-Bank servers for that domain. Mandiant’s review of available 2017 data did not support the supposition that communication with the target host occurred. The letter also raised concerns about suspicious cyber activity aimed at Alfa-Bank and about how some DNS logs were apparently obtained and disclosed. Those qualifications do not establish either a covert communications channel or a fabricated investigation. The Senate letter reproduces the technical discussion.
The technical analysis quotes RFC 1035: “The goal of domain names is to provide a mechanism for naming resources in such a way that the names are usable in different hosts, networks, protocol families, internets, and administrative organizations.” The point for readers is that DNS helps locate a named resource; observing a DNS request is not, by itself, evidence that a connection to that resource followed. The letter’s reproduced Mandiant analysis provides the context for that distinction.
How a VPN changes what a website sees
For sensitive online research, FPF recommends using a VPN. A website reached through a VPN sees the VPN server’s IP address rather than the reporter’s home or workplace address. That can make a newsroom-associated IP less visible to the site being investigated.
FPF also says a VPN may reduce an internet service provider’s visibility into browsing and protect traffic from some monitoring on untrusted Wi-Fi. Those are specific changes to what certain observers can see, not a promise of complete anonymity or protection from every kind of surveillance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choosing a safer research workflow
GIJN names IVPN, Mullvad, and ProtonVPN as VPN examples and points to Tor Browser as an option for added anonymity. These are examples, not endorsements; suitability and features depend on a journalist’s circumstances and newsroom policy. Consider the following questions before sensitive browsing:
- What observer are you trying to limit? A VPN changes the IP address visible to the visited website and can reduce an ISP’s view of browsing; it does not erase every trace elsewhere.
- Could the destination identify a newsroom address? Avoid exposing a recognizable office or home IP when visiting sites controlled by people under investigation.
- Are you on untrusted Wi-Fi? A VPN can protect traffic from some local network monitoring, but it is only one layer of security.
- Does the approach fit newsroom policy? Use tools and procedures that your organization can support and maintain.
- What risks remain? A VPN does not protect against phishing. Keep devices updated, use strong unique passwords and a password manager, and enable two-factor authentication.
For additional options and journalist-focused help, consult GIJN’s digital-security resources. No single tool makes a journalist anonymous or safe from all forms of monitoring.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
