VPN and Proxy Detection Explained: What the Signals Really Show

The question these tools are answering

A website that wants to know whether a visitor is using a virtual private network is not asking an existential question. It is asking a narrower one: does this address belong to the kind of network a consumer’s device would normally connect from? The answer is inferred from how the address is registered and from how it behaves, and every inference in that chain has a failure mode.

That framing matters because the popular description of these tools — “detects VPN usage” — implies a certainty the data does not support. What actually exists is a set of observations about an address, each with a source and each capable of being wrong, and the honest presentation is a list of those observations rather than a single verdict.

What the signals are built on

The strongest input is registration. Address ranges are allocated to organisations, and an allocation to a hosting provider is a matter of record. A connection arriving from a range that belongs to a cloud provider is therefore different in kind from one arriving from a residential range, and no behavioural analysis is needed to notice it. This is the same ownership data that the ASN lookup reports, which is why an organisation name and a data-centre flag frequently appear together.

The second input is behaviour observed across many requests. An address that appears from many unrelated sessions, that authenticates to services at volumes no household produces, or that is known to have been used for abuse is statistically unlike a home connection. Providers accumulate these observations and publish them as risk indicators.

A third input is the structure of the address itself. Certain ranges are reserved for private use, some are documented as unallocated, and some are known to be used only for network infrastructure. An address in such a range appearing as a visitor is notable in itself, and the signals that describe this are reported as separate facts rather than folded into a score.

Why the providers disagree

Each provider maintains its own list of ranges and its own update schedule. A range reassigned from a hosting provider to a consumer internet provider will be labelled the old way by one service for months after the other has updated. A range used by a corporate network with many users may look residential to one model and suspicious to another.

There is also a definitional divergence that no amount of data resolves. Hosting providers increasingly offer network infrastructure that behaves like a consumer connection, and consumer providers increasingly route traffic through data-centre facilities. An address can legitimately be described either way depending on which fact the provider considers decisive.

The practical consequence is that comparison is more useful than a single answer. A site visitor who wants to understand why they were challenged should look at which signals were raised and by whom, not at whether one provider said yes. This is the reason the IP purity check and the IP reputation check present each provider’s observations separately and name the source of every one.

The false positives worth knowing about

Four categories account for most of them. Corporate networks, which route employee traffic through a central facility that is registered as a data centre and is therefore indistinguishable from one. University and public networks, which share one address among many users and therefore show volumes no household produces. Provider reassignment, as described above. And privacy features built into browsers, which change how a session appears without being a virtual private network at all.

None of these are edge cases. A meaningful fraction of legitimate traffic arrives from an address that some provider has flagged, which is why an inference about an address should never be presented as a conclusion about the person behind it. The note attached to every result on this site says as much, and it is a statement about the limits of the evidence rather than a formality.

There is a fifth category worth naming because it is the one people notice first and understand least: mobile networks. A phone can be assigned an address from a pool that is shared across a large region and reallocated between sessions, so the same device can appear in a different city on consecutive requests. Nothing has changed except which address the network handed out, and any inference drawn from either one is equally provisional.

What an address cannot tell anyone

It cannot identify a person. There is no public mapping from an address to a named subscriber, and the databases that hold such mappings are not open to public queries. A flag describes a network attachment point, and saying more than that would be a claim the data does not support.

It cannot tell whether the person is doing anything wrong. Using a virtual private network is ordinary, legitimate and frequently recommended, and an address belonging to one is not evidence of intent. The relevant question for a service is usually whether a visitor should be treated differently, and that is a policy decision rather than a measurement.

It cannot establish location. The approximate region attached to an address describes where the address is registered or routed, which for a virtual private network is the exit node rather than the user. A visitor shown in one country while sitting in another is the expected result rather than an error — the IP check explains the same limitation in the context of a single address.

It also cannot tell you whether your connection is being intercepted. Translation, routing and inspection are separate subjects; the behaviour of your own router is described in the NAT type check, and the address family the connection uses is reported by the IPv6 test. For the order to work through these questions without conflating them, the network guide is the starting point.