System and method of user tracking by digital handprint

A system for tracking a malicious user, comprising:

• a processor;
• and
• a memory communicatively coupled to the processor, wherein the memory stores a plurality of instructions, which, on execution, causes the processor to:
• receive a plurality of client-side attributes indicative of a first unique client identifier;
• generate based on pre-processing data, a first tampering signal confidence value based on the client-side attributes collected for the first unique client identifier;
• transmit the first unique client identifier and one or more secondary attributes to a server, wherein the one or more secondary attributes is indicative of a second unique client identifier;
• combine the one or more secondary attributes with additional networking information of a client, wherein the additional networking information comprises one or more of an Internet Protocol (IP) address of a client device and a Transport Layer Security (TLS) fingerprint of the client device;
• create the second unique client identifier based on the one or more secondary attributes and the networking information (including one or more of the IP address and TLS fingerprint) of the client device;
• apply an additional signal;
• determine that a second unique client identifier signal strength value of the client device meets a predetermined threshold value, wherein the second unique client identifier signal strength is reduced upon determining one or more of an association of the IP address with a virtual private network (VPN), an identification of the IP address as a shared IP address, an identification of an anonymized traffic source, an identification of a manipulated network connection, and an identification of one or more manipulated network attributes;
• responsive to determine the second unique client identifier of the client device meets the predetermined threshold value, determine that one or more of the first unique client identifier and the second unique client identifier are not present in a database;
• and
• create a third unique client identifier responsive to determining that the first unique client identifier and the second unique client identifier are not present in the database, wherein the third unique client identifier is created by combining the first unique client identifier and the second unique client identifier to track the malicious user.

A non-transitory computer-readable storage medium in a distributed computing system, the non-transitory computer-readable storage medium having instructions stored thereupon which, when executed by a processor, cause the processor to:

• receive a plurality of client-side attributes indicative of a first unique client identifier;
• generate based on pre-processing data, a first tampering signal confidence value based on the client-side attributes collected for the first unique client identifier;
• transmit the first unique client identifier and one or more secondary attributes to a server, wherein the one or more secondary attributes is indicative of a second unique client identifier;
• combine the one or more secondary attributes with additional networking information of a client, wherein the additional networking information comprises one or more of an Internet Protocol (IP) address of a client device and a Transport Layer Security (TLS) fingerprint of the client device;
• create the second unique client identifier based on the one or more secondary attributes and the IP address of the client device;
• apply an additional signal;
• determine that a second unique client identifier signal strength value of the client device meets a predetermined threshold value, wherein the second unique client identifier signal strength is reduced upon determining one or more of an association of the IP address with a virtual private network (VPN), an identification of the IP address as a shared IP address, an identification of an anonymized traffic source, an identification of a manipulated network connection, and an identification of one or more manipulated network attributes;
• responsive to determine the second unique client identifier of the client device meets the predetermined threshold value, determine that one or more of the first unique client identifier and the second unique client identifier are not present in a database;
• and
• create a third unique client identifier responsive to determining that the first unique client identifier and the second unique client identifier are not present in the database, wherein the third unique client identifier is created by combining the first unique client identifier and the second unique client identifier to track the malicious user.