What Is IP Spoofing (IP Sahteciliği)? The Problems It Causes in Criminal Investigations

Last updated: 17.10.2026 · Author: Attorney Coşkun Genç, Istanbul cybercrime lawyer

What Is IP Spoofing?

One of the problems that may arise in reaching the real perpetrators following the identification of IP addresses is IP spoofing. IP spoofing means that attackers craft their requests directed at a target so that they appear to come from one or more fake internet addresses. IP address spoofing is a significant part of the difficulty of attribution: if the packets from which the attack originates are marked as if they came from a fake source machine, identifying the real source and, as a result, identifying the perpetrator or perpetrators will be extremely difficult.

How does IP spoofing differ from email spoofing and caller ID spoofing?

The word "spoofing" generally describes presenting the identity of a source falsely; the difference between the types emerges in which field is spoofed. In IP spoofing, the source address field of the network packet is altered; in email spoofing, the sender address and the message headers are altered; and in caller ID spoofing, the number displayed on the screen of the person being called is altered. From the perspective of the investigation, the consequence also differs: in IP spoofing, the address appearing in the service provider's record may belong to an innocent subscriber; in email spoofing, the real trace is sought in the message headers and server logs; in caller ID spoofing, the number displayed on the screen and the real originating information in the operator's records may diverge from one another.

How Does IP Spoofing Work?

In an IP spoofing scenario, the attacker does not need any information about the identity of the real user being targeted. When the attacker sends packets with a fake source IP address, the returning responses reach the real user; however, that user, confronted with data traffic he or she did not expect, cannot access the service he or she was actually supposed to receive. While this opens the door to unauthorised persons interfering with network traffic, it may at the same time render legitimate users unable to obtain service by consuming network bandwidth.

In Which Attacks Is IP Spoofing Used? (DDoS)

One of the fundamental causes of IP spoofing is the weakness in existing IP networks. This deficiency enables an unauthorised user to flood the network with IP packets containing random source IP addresses. The commonly encountered problem is DDoS (distributed denial-of-service) attacks, which arise from fake packets sent by unauthorised users consuming the bandwidth of real users.

In practice, IP spoofing is seen most often in attacks for which one-way traffic suffices: foremost among these are flood attacks, which overwhelm the target with connection requests, and reflection attacks, in which the victim's address is given as the source so that the responses of third-party servers are directed at the victim. Botnets made up of compromised devices generate this traffic in a distributed manner; the address of a real subscriber may be used as the fake source address. By contrast, concealing the real address through a VPN, a proxy or similar intermediaries is not spoofing in the technical sense: there, the packet genuinely leaves from the address of the intermediary server; in the investigation, however, the identified IP again belongs not to the perpetrator but to the intermediary or to an innocent system hosting the intermediary.

Why Is the TCP Protocol Resistant to Spoofing?

It should be noted at this point that, while IP spoofing attacks can be used with all protocols, in applications using the TCP (Transmission Control Protocol) protocol, establishing a complete session with a fake address becomes considerably more difficult. The main reason for this is that the sequence numbers contained in the TCP header are generated unpredictably, and that the TCP protocol requires the three-way handshake to be completed between both endpoints before a connection is established. Unless these stages are completed, data transfer between the two endpoints cannot take place through normal means. For this reason, the TCP protocol provides a network connection that is highly secure against IP spoofing.

How Does IP Spoofing Turn Innocent Persons into Suspects?

By its very nature, IP spoofing not only allows the real perpetrators to be masked, but may also cause innocent persons who have not committed any act defined as an offence to come under simple suspicion. From the perspective of the judicial authorities, this situation may be likened to clearing one's browsing history in order to remove all internet searches that could be evidence of illegal activity.

These methods aimed at concealing identities harm both ISPs and the judicial authorities: ISPs may be misled as regards developing their ability to scan customers' historical logs, presenting relevant advertisements and making other improvements, while for the judicial authorities they may cause serious problems in terms of tracking offenders online. This is because, through this spoofing method, since the real user did not use the IP address he or she had been using in any act constituting an offence on the date the offence was committed, the real user's IP address has been used by another person as an instrument for carrying out acts constituting an offence.

Is an IP Record Alone Sufficient Evidence in Criminal Proceedings?

No; an IP record alone is not sufficient for a conviction. Under Article 217 CCP, the offence charged may be proven by any kind of lawfully obtained evidence, but the judge assesses this evidence freely according to his or her personal conviction. An IP match shows only that the address was allocated to a particular subscriber at a particular moment; it does not show who was sitting at the keyboard at that moment. Unless the possibilities of spoofing, an open wireless network, a device compromised by malware or an intermediary server are ruled out, the link between the subscriber and the perpetrator cannot be regarded as established.

The second factor that magnifies this uncertainty is CGNAT: operators share a single public IP address among hundreds of subscribers at the same time; for this reason, a subscriber query made without the port number and a timestamp accurate to the second may point to the wrong person. We have examined this subject in detail in our article on IP address and CGNAT records, and the scope of communication records in our article on HTS records.

The approach of the Court of Cassation is consistent. In a recent decision concerning the offence of theft committed through the use of information systems, even the fact that the line to which the IP used for the transactions was connected had been opened by the defendant's dealership was not considered sufficient for a conviction:

"…without regard to the facts that a judgment of conviction cannot be established solely on the basis of the IP number unless it is supported by a confession or other evidence, that there is no finding within the scope of the case file as to by whom, and with which telephone or device having computer features, the … line was actually used after it had been obtained by the defendant, and that no content search could be carried out on the mobile phone or other device …, the rendering of a judgment of conviction of the defendant in the written manner, instead of his acquittal of the offence charged"

Court of Cassation, 2nd Criminal Chamber, E. 2023/29020, K. 2025/4493, 13.03.2025

In another case file directly addressing IP spoofing, it was established that the mobile banking transactions had been carried out over the IP belonging to the defendant; however, the judgment of acquittal based on the specialist expert report in the file was upheld by the Court of Cassation. The report cited in the decision explains that an IP can be spoofed in two ways:

"…firstly, by using a proxy system, the suspect or suspects carrying out the transaction conceal their own … IP and use IP addresses belonging to proxy systems; as a result of this operation, an IP address belonging to another person is identified, but that person did not carry out the transaction. Secondly, as a result of virus- or trojan-type data being placed on the computer whose IP has been identified, the method of unauthorised remote access to the computer is used by means of these viruses. … In short, the accuracy of the IP addresses identified in relation to transactions pertaining to all kinds of connections made over the internet is not guaranteed."

Court of Cassation, 2nd Criminal Chamber, E. 2021/10836, K. 2023/5219, 05.10.2023 (expert report cited in the decision; the judgment of acquittal was upheld)

How Is a Spoofing Objection Raised in the Defence?

A spoofing objection is not built by saying "the IP may have been spoofed"; each link in the chain of findings in the file is questioned separately, and a concrete request for investigation is drafted for every missing link. The Court of Cassation has likewise held that, "since it is possible for an IP number belonging to another person to be used", the truthfulness of the defendant's defence must be investigated by means of a specialist expert report, and has regarded a judgment rendered on an incomplete examination as a ground for reversal (Court of Cassation, 2nd Criminal Chamber, E. 2014/31000, K. 2017/4754, 26.04.2017). The order to be followed is as follows:

1. Request the basis of the identification: It is established from which institution, by which letter and on the basis of which decision the IP information was obtained. Under Article 135(6) CCP, the identification of communications requires a decision of a judge or, where delay would be prejudicial, of a public prosecutor; a record obtained without a decision is unlawfully obtained evidence.
2. Question the port and timestamp: It is asked whether the subscriber query was made by specifying the source port number, the time accurate to the second and the time zone (UTC/Turkish time); on lines using CGNAT, matching without these is unreliable.
3. Scrutinise log integrity: The original version of the server or website logs, their hash value, who exported them and when, and whether they have been altered are requested; a "log" in the form of a screenshot does not by itself qualify as a source.
4. Request an examination under Article 134 CCP: A search, imaging and backup of the suspect's computers and telephones are carried out in accordance with due procedure; a copy of the backup is given to the suspect under Article 134(4). The absence of any trace of the offence strengthens the defence.
5. Request an expert examination: Under Article 63 CCP, an IT specialist expert witness is asked about the type and password of the modem, the possibility of external access to the wireless network, any trace of malware or remote access on the device, and whether the traffic passed through an intermediary server.
6. Point to an alternative perpetrator and the absence of a link: Through elements such as acquaintance with the victim, any relationship with the account to which the money went, the capability of the devices and location at the time of the offence, it is demonstrated that the suspect's link to the act cannot be established; application of the principle of in dubio pro reo is requested.

Article 134 CCP makes the search and copying of computers and computer records subject to the existence of strong suspicion based on concrete evidence and the impossibility of obtaining evidence by other means and, as a rule, to a decision of a judge; it provides for the backing up of all data during seizure and for a copy to be given to the suspect upon request. By its decision dated 12.02.2026, E. 2023/128, K. 2026/36, the Constitutional Court annulled this article and ruled that the annulment shall enter into force nine months after its publication in the Official Gazette (25.02.2027); until that date, the existing article continues to apply to examinations carried out. The 8th Criminal Chamber of the Court of Cassation has likewise reversed, on the following grounds, a conviction concerning card transactions carried out over an IP, which had been rendered without any device examination and solely on the basis of the IP allocation:

"…in the specific case, having regard to the defendant's statement that he used his internet connection without a password, the fact that the online purchases were made within a certain time interval, and the entire content of the case file, the rendering of a judgment of conviction in the written manner instead of acquittal, without taking into account that, contrary to the defence, there is no conclusive and concrete proof or proofs, free from all doubt, as to whether the online purchases made by using the victim's credit … details were made by the defendant, an ADSL internet user, has not been found to be in accordance with the law."

Court of Cassation, 8th Criminal Chamber, E. 2022/2084, K. 2023/522, 14.02.2023

Which documents should be requested?

• ✓The decision on the identification of communications on which the IP identification is based, and the request letter (Article 135(6) CCP)
• ✓Response letter of the operator/ISP: IP, port, date and time, time zone, CGNAT information
• ✓Original log files of the victim's system and their hash values
• ✓The search decision under Article 134 CCP, the seizure and backup reports, and the copy given to the suspect
• ✓Digital forensic and expert reports; modem and device information
• ✓Where applicable, the complaint file concerning the misuse of the suspect's own IP

Common mistakes and exceptions

• The wrong type of objection: In transactions requiring a login (internet banking, social media login), pure IP spoofing is technically difficult; here, the objection should be built on the possibility of an open wireless network, malware or an intermediary server.
• Delay: Device and modem examinations lose their significance over time; Court of Cassation decisions have emphasised that an examination carried out years later will not produce reliable results. The request should be made at the beginning of the investigation.
• Ignoring supporting evidence: If there is a trace of the offence on the device, if the money reached the suspect or if there is a confession, the IP objection alone will not produce a result; the defence must also respond to this evidence separately.
• Errors on the victim's side: A complaint that reports only the IP without providing port and time information may end in a decision of non-prosecution or an acquittal; the victim, too, must preserve log integrity from the outset.

Which Offences Does IP Spoofing Bring into Play? (Articles 243 and 244 TPC)

IP spoofing is not an independent type of offence under the Turkish Penal Code; which offence arises is determined by the outcome of the act carried out with the fake address. Rendering a server unable to provide service by means of fake packets brings into play the offence of hindering or disrupting a system under Article 244(1) TPC; entering the system and altering data brings into play Article 244(2); obtaining an unjust benefit in this way, where the act does not constitute another offence, brings into play Article 244(4). If the fake address was used only to conceal unlawful access to the system, Article 243 TPC applies. If the act was directed at transferring money from a bank account or at deception, theft through information systems (Article 142(2)(e)) or aggravated fraud (Article 158(1)(f)) comes to the fore.

Article 243 TPC covers any person who unlawfully enters the whole or any part of an information system or continues to remain therein; the sanction is imprisonment for up to one year or a judicial fine. For systems that may be used in return for payment, the penalty is reduced by up to one half; where data are destroyed or altered as a result of the access, imprisonment of six months to two years is provided for. The fourth paragraph, added in 2016, punishes the monitoring of data transfers by technical means without entering the system with imprisonment of one to three years. Article 244 TPC, in turn, provides for imprisonment of one to five years for a person who hinders or disrupts the functioning of the system, and of six months to three years for a person who corrupts, destroys, alters, renders inaccessible or sends elsewhere data; for systems of a bank, a credit institution or a public institution, the penalty is increased by one half, and where an unjust benefit has been obtained, imprisonment of two to six years and a judicial fine of up to five thousand days are imposed. For the innocent subscriber whose IP has been spoofed, the problem is being confronted with the status of suspect in an investigation opened in respect of these offences; it is precisely at this point that the objection steps above become important.

Challenging IP Evidence with an Istanbul Cybercrime Lawyer

In case files based on IP identification, three points determine the outcome: whether the IP record has been verified by port and timestamp, whether the device and modem examination was requested at the beginning of the investigation, and whether the possibility of spoofing or unauthorised use has been brought into the file through an expert report. Av. Coşkun Genç Law Office provides legal assistance in cybercrime investigations and prosecutions conducted in Istanbul at the stages of preparation before the statement, drafting requests for the collection of evidence, objections to measures under Articles 134 and 135 CCP, and the technical assessment of expert reports. In our work as an Istanbul cybercrime lawyer, the aim is to prevent an IP match from turning into an accusation on its own and to have the gaps in the chain of evidence recorded in the file in good time.

Those wishing to obtain the assistance of an Istanbul cyber crime attorney may request a preliminary assessment through our contact page, together with the summons to give a statement or the indictment served on them, any operator response letter and expert report, and information concerning their own internet subscription. For the general course of the investigation process and choosing a lawyer, see our article on the cybercrime lawyer; for our field of practice, see our cybercrimes page.

Sources

1. Turkish Penal Code (TPC, Law No. 5237), Articles 243, 244 – mevzuat.gov.tr · Art. 243 · Art. 244
2. Code of Criminal Procedure (CCP, Law No. 5271), Articles 63, 134, 135, 217 – mevzuat.gov.tr · Art. 134 · Art. 135 · Art. 217
3. Constitutional Court, E. 2023/128, K. 2026/36, 12.02.2026 (annulment of Article 134 CCP; entry into force 25.02.2027)
4. Court of Cassation, 2nd Criminal Chamber, E. 2023/29020, K. 2025/4493, 13.03.2025
5. Court of Cassation, 2nd Criminal Chamber, E. 2021/10836, K. 2023/5219, 05.10.2023 – mevzuat.adalet.gov.tr
6. Court of Cassation, 8th Criminal Chamber, E. 2022/2084, K. 2023/522, 14.02.2023
7. Court of Cassation, 2nd Criminal Chamber, E. 2014/31000, K. 2017/4754, 26.04.2017