VPN detection
VPN detection is how websites identify traffic from VPN and proxy services, using IP ownership data, blocklists, and browser consistency checks.
What VPN detection is
A VPN hides your traffic from your ISP and replaces your address with the VPN server's, but it does not make the server's address anonymous. VPN detection is the set of techniques websites use to decide that an address belongs to a VPN or proxy service rather than to a person at home. None of them requires breaking the encryption; they work on what the server can see.
How websites do it
- Network ownership. The server's address is announced by an ASN. If that network is a hosting provider, the address is a datacenter IP, and the overwhelming majority of VPN exits are. If the network's name contains "VPN", "proxy", or a well-known service name, the conclusion is immediate.
- Published and commercial lists. The Tor Project publishes its exit nodes. Commercial feeds track VPN ranges by signing up for services and recording exit addresses. Blocklists record abuse from shared exits.
- Address sharing. One address with sessions from many countries, many languages, and many device types in a short time is a shared exit.
- Browser consistency. The time zone, language, WebRTC, DNS resolver, and IPv6 of a real visitor all agree with the address. A VPN user's often do not.
- Transport fingerprints. Packet TTL, TCP window sizes, and MTU values differ between a direct connection and a tunneled one. These need raw packet access and are used by dedicated fraud systems rather than ordinary web servers.
What we check
The proxy checker applies the ownership and list checks: hosting classification from the ipcat datacenter list and ASN keywords, the Tor exit list, the Spamhaus DROP list, and a VPN-provider rule that matches network names containing words like VPN, proxy, anonymous, or privacy, or the names of major VPN services. The anonymity score adds the browser consistency checks and shows every deduction with its reason: 25 points for a hosting network, 20 for a known VPN or proxy network, 40 for Tor, and 10 for proxy headers, among others.
What a good result looks like
A residential or mobile address with no list hits, a matching time zone and language, no WebRTC or DNS resolver outside the tunnel, and no IPv6 reachable from the real connection. A commercial VPN on a datacenter range cannot achieve this; it can at most avoid the browser leaks.
A common misconception
"My VPN has obfuscation" addresses ISP-level blocking of the VPN protocol. It does nothing about the exit address, which is what websites see.