Thanks. That clears it up. But isn’t the very purpose of the service sort of offered with a ‘Nod & a Wink’?
Services like CTunnel operate fairly openly, and they generate revenue from the advertising they add to the web pages. They make the task of tracing visitors more difficult, but not necessarily impossible, as this investigation proves. (Of course, it helped that the hacker posted a public confession with his public e-mail address.)
There are more surreptitious ways to disguise an IP address, like using a generic proxy server that is “accidentally” available for access. But some of those servers are actually traps to intercept passwords and other confidential information from the user.