Using a new proof-of-concept, local and public IP addresses can be extracted from candidate messages sent by the API Directory’s STUN protocol requests .