How to Detect VPNs and Proxies by IP
VPNs and proxies hide a user's true network and location. Learn how known-VPN flags and datacenter classification detect anonymized traffic in real time.
When someone hides behind a VPN or proxy, they're removing one of the most useful pieces of context you have about them: where they actually are and what network they're really on. Plenty of privacy-conscious people use VPNs for legitimate reasons, but VPNs and proxies are also the default tooling for fraud, ban evasion, and location spoofing. Knowing when traffic is anonymized lets you decide how much to trust it.
Why anonymized traffic raises risk
- Location spoofing: appearing to be in a permitted or lower-risk country.
- Ban and rate-limit evasion: rotating exit IPs to dodge blocks.
- Coordinated abuse: running many 'users' that all actually originate from a handful of datacenter ranges.
How VPN and proxy detection works
Detection rests on two complementary signals. First, network classification: consumer traffic comes from residential ISPs, while VPNs and proxies overwhelmingly exit through datacenter and hosting networks. Second, known-VPN intelligence: maintained lists of IP ranges operated by commercial VPN providers. Together they catch both the obvious commercial VPNs and the DIY proxies running on cloud servers.
curl -X POST https://api.riskunified.com/ip_risk \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"ip": "185.48.52.69"}'RiskUnified's IP Risk API returns known_vpn, the network classification (residential / datacenter / proxy), a classification_confidence score, and the operating ISP and ASN, so you can distinguish a residential connection from a cloud-hosted exit node.
{
"ip_features": {
"isp": "Latitude.sh",
"classification": "datacenter",
"classification_confidence": 0.7,
"known_vpn": true
},
"risk": { "level": "high" }
}Responding proportionally
A VPN is not proof of fraud, so calibrate. For low-stakes browsing, ignore it. For account creation, payments, or payouts, treat known_vpn or a datacenter classification as elevated risk and layer on step-up verification, especially when it coincides with a disposable email or VoIP phone.
classification_confidence to avoid over-reacting to borderline cases. A 0.9 datacenter classification is a much stronger signal than a 0.5 one.Frequently asked questions
How do you detect a VPN by IP?
By classifying the network the IP belongs to, VPNs and proxies exit through datacenter/hosting networks rather than residential ISPs, and by checking the IP against known commercial VPN ranges.
Is VPN traffic always fraudulent?
No. Many legitimate users run VPNs for privacy. Treat it as a weighted risk signal and raise friction on high-value actions rather than blocking outright.
What's the difference between a VPN and a proxy here?
Both anonymize the true origin. Detection treats them similarly: they surface as datacenter/proxy classifications or known-VPN ranges rather than residential connections.
Try RiskUnified free
Score email, phone and IP risk from one API. 500 free credits every month, no credit card required.